fix: Require node update access on the Canvas Override and Reset layout routes

Problem/Motivation

Neither /node/{node}/canvas nor the reset routes check access to the node itself. CanvasTabAccessCheck and CanvasResetAccessCheck grant access purely on a Canvas Override permission plus the bundle's third-party setting. reset canvas layout is not restrict access: true, so it can be handed to low-privilege roles — the permissions documentation even suggests a "Reset Manager" role holding only that permission.

A user holding such a permission can open the per-content editor, or wipe the stored layout, of any node of an enabled content type — including unpublished content owned by others that they cannot even view. Both actions modify the node, so they must also require the node's own update access.

Steps to reproduce

• Drupal core 11.4 or Drupal CMS, canvas_override enabled on a content type.
• Give a role only reset canvas layout (no node edit access) and log in as such a user.
• Visit /node/{nid}/canvas/reset for someone else's node of that type: the confirm form loads and the reset succeeds, destroying the stored layout.

Proposed resolution

The editor route additionally requires the node's update access (editing a layout edits the node). The reset routes additionally require view access: the dedicated reset canvas layout permissions deliberately support a reset-only role without full edit rights, but a user must at least be able to see the node they reset — closing the hole for unpublished or otherwise hidden content. Entity access cacheability is merged through the returned access result.

Remaining tasks

• ✅ File an issue about this project
• ✅ Addition/Change/Update/Fix to this project
• ✅ Testing to ensure no regression
• ✅ Automated unit/functional testing coverage
• ➖ Developer Documentation support on feature change/addition
• ➖ User Guide Documentation support on feature change/addition
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ✅ Reviewed by a human
• ✅ Code review by maintainers
• ✅ Full testing and approval
• ✅ Credit contributors
• ✅ Review with the product owner
• ✅ Update Release Notes
• ✅ Release canvas_override-1.0.0

User interface changes

• N/A

API changes

• Route access for /node/{node}/canvas and /node/{node}/canvas/reset now additionally requires node update access.

Data model changes

• N/A

Release notes snippet

• The per-content editor and reset routes now also require update access to the node, so Canvas Override permissions no longer allow editing or resetting layouts on content the user cannot edit.