Add access handler cache metadata to ExperienceBuilderController

See the caveats I added at #3529895-12: Provide the client with `create` operation access information similar to #3516657 → , and the patch attached there, which almost passes. It'd have allowed this to use XbResourceLinkCollection, just like \Drupal\experience_builder\Controller\ApiContentControllers::getEntityOperations().

See #3533449-12: Users without 'use experience builder ai' can open XB AI agent → which touches this.

Thanks, @penyaskito!

🐛 After source session timeout, XB page stuck on the error message Active almost touches this.