Access control on admin paths should not rely on administrator role

Problem/Motivation

When installing a site from a minimal install profile, there is no 'administrator' role, so its presence cannot be assumed for all site implementations.

Within domain_entity_entity_access() there is a check for $user->hasRole("administrator") which is an attempt to return an early neutral access result on admin routes. The issue is that this ought to be permission based, rather than a role check.

The use case (hopefully a fairly broad requirement) we have users with a 'content editor' role with the 'publish to any domain' permission assigned. Given this permission comes from the domain_access module (a dependency of domain_entity) and this permission is used elsewhere in this module's code, the suggestion is to add an additional check for this permission and not rely on the administrator role. As existing sites may already be relying on the $user->hasRole("administrator") part we should probably leave it in place unless the maintainers agree a permissions based approach is best.

Steps to reproduce

Create domain records for 'gb' and 'de'
Install domain_entity and assign to a taxonomy vocab in the usual way - following steps in the README.
Create a taxonomy term and assign to 'gb'.
Try to edit the term on the 'de' domain with a user that doesn't have the administrator role.
Results in access denied.

Proposed resolution

if ($is_admin && ($user->hasRole("administrator")))

...should become something like...

if ($is_admin && ($user->hasRole("administrator") || $user->hasPermission('publish to any domain')))

Remaining tasks

Seek maintainers thoughts as to whether this approach is safe and ideal.
Are there alternative approaches, such as a new permission managed by the module, that could be used?

User interface changes

None.

API changes

Some sites may use the 'publish to any domain' permission in such a way that if used here for access control results in undesired behaviour. I can't see this really being common because the nature of the permission is that it's an admin level permission anyway where broad access control is granted.

Data model changes

None.