No access check on Referenced entities

we need that, i take this issue

MR !545 is ready. The scope is a bit larger than the title: the same problem exists in the other sources that give data from things Drupal protects, so the MR fixes them all the same way. The rule is the one core uses before it renders something: check access with an access result object, keep the cacheability of that result even when access is denied, and give nothing when it is denied.

What changes:

- Referenced entities (EntityReferencedDerivableContext): the referenced entity is translated for the display language, then "view" access is checked on that translation, only allowed entities become contexts, and the field index now selects a field delta, so a denied delta gives nothing instead of the next entity. This is what core does in EntityReferenceFormatterBase::getEntitiesToView().
- Field values (FieldValueSourceBase, used by the field property sources): "view" access on the field is checked, like core does before a formatter runs. Example: the email of another user is no longer readable.
- Blocks (BlockSource): the block plugin access is checked before build(), like a placed block. blockAccess() now counts.
- Entity links (EntityLinksSource): the URL access is checked, like a link element. No more edit or delete URL for users who cannot open them.

To carry the cacheability, sources and derivable contexts implement RefinableCacheableDependencyInterface and ComponentElementBuilder merges it into the component render array. Interfaces are not changed.

new tests, all red on 2.0.x before the fix: one kernel test per source, a kernel test that renders a component and checks what the renderer bubbles, and a functional test where a hidden referenced node shows up once published with a warm page cache, the same scenario as core's Layout Builder cache tags test. The existing entity link fixture now runs as an editor, because an edit URL for an anonymous user was the bug.

This also fixes the wrong language of referenced entities reported in #3562508: Is Ui Patterns with sdc usage compatible with multilingual websites?, because translation and access have to happen at the same place.

Not tested on my local environement but the MR looks good:

• usage of RefinableCacheableDependencyInterface and RefinableCacheableDependencyTrait
• usage of Url::access() in EntityLinksSource
• usage of AccessibleInterface::access() in BlockSource