Hide disabled sub-properties of address elements

Problem/Motivation

Elements are exposed off the built form, and the shared element walker WebformElements drops any child whose #access is denied (see WebformElements::isAccessAllowed()). That is what keeps disabled composite sub-properties out of the schema, the behaviour discussed in #3571739: Define how to handle invisible properties of composite elements.

The webform_address element does not go through that walker. Its items field is resolved by a dedicated WebformAddressCompositeItems producer that iterates #webform_composite_elements and returns every entry that is simply !empty(), with no access check:

foreach ($elementKeys as $key) {
  if (!empty($element[$key])) {
    $elements[] = $element[$key];
  }
}

So a disabled address sub-property (for example a field configured with #state_province__access: false) still carries #access => FALSE in the built composite and is returned through items, while the equivalent sub-property on a name, contact or custom composite is correctly omitted. The address element is the one composite that leaks disabled sub-properties.

Steps to reproduce

1. Add a webform_address element to a webform and disable one of its sub-elements (e.g. set State/Province access off).
2. Query the form and read the address element's items.
3. The disabled sub-element is present in items, even though disabling the same sub-element on any other composite hides it.

Proposed resolution

Apply the same access filtering to the address composite that every other composite already gets. Either reuse the access check from WebformElements inside WebformAddressCompositeItems, or route the address element's children through the shared walker so there is a single place that decides element visibility.

Extend the test webform's webform_address element with a disabled sub-element and assert it is absent from items, so the behaviour is pinned and matches the other composites.

Remaining tasks

• Filter denied #access sub-elements in the address resolver (or delegate to the shared walker).
• Add a disabled sub-element to the address element in the test fixture.
• Add coverage asserting the disabled address sub-property is omitted from items.
• Run phpunit / phpcs / phpstan.

API changes

Disabled address sub-properties will no longer be returned by the address element's items field, bringing it in line with all other composites. This is a correctness fix to resolver behaviour, not a schema/SDL surface change, so it does not need a change record; the GraphQL types and fields are unchanged.

Release notes snippet

The address element now hides disabled sub-properties from its items field, matching the behaviour of all other composite elements.