Pending changes leaking entities that user might have no access to

Left some comments on the MR

Working addressing @larowlan MR comments

I chatted with @larowlan and he was ok with his 2 remaining questions to be handled in follow-ups. so I created 🐛 Determine if names of unviewable entities in cache tags of /xb/api/v0/auto-saves/pending is information disclosure Active (I would have liked this nid to end in a 3) and 📌 ApiAutoSaveControllerTest::testPost should use a less power for permission than 'bypass node access' Active

If this comes back green I will merge

📌 Create UI for selective publishing of changes Active and this issue both passed tests on their own but in combo make \Drupal\Tests\experience_builder\Kernel\ApiAutoSaveControllerTest::testDelete fail.

Will open up follow-up MR

media library e2e test failed. Guessing not related.