Add access handler cache metadata to ExperienceBuilderController

See the caveats I added at #3529895-12: Provide the client with `create` operation access information similar to #3516657 → , and the patch attached there, which almost passes. It'd have allowed this to use XbResourceLinkCollection, just like \Drupal\experience_builder\Controller\ApiContentControllers::getEntityOperations().