fix: Record complete cacheability in entityViewAlter and menuLocalTasksAlter

Problem/Motivation

Two hooks vary their output without declaring what they vary on:

• entityViewAlter() adds the user.permissions cache context only inside the permission-granted branch. If the node build is first cached for a user without any Canvas Override permission, the cached build carries no permission variation and is reused for an editor — the core/htmx library is then missing and the Reset tab's confirm shortcut silently degrades. Cache-order dependent and intermittent.
• menuLocalTasksAlter() unsets tabs based on five permissions and the node type's third-party setting, and embeds the node label in the hx-confirm message, but only ever adds the session cache context (and only on the HTMX branch). Cached local tasks can leak tabs to users without the permissions, keep showing tabs after Canvas Override is disabled on the type (the early return happens before any dependency is recorded, so config invalidation cannot reach it), and show a stale title in the confirm prompt.

Steps to reproduce

• With render caching on, load a node of an enabled type as a user without Canvas Override permissions, then as a webmaster: the webmaster's page is served from cache without the htmx library.
• Disable Canvas Override on the content type: the Canvas Override / Reset tabs remain on previously cached node pages until a full cache flush.

Proposed resolution

Add the user.permissions context unconditionally in entityViewAlter(), and in menuLocalTasksAlter() record the node type config dependency, the user.permissions context and the node dependency before any early return.

Remaining tasks

• ✅ File an issue about this project
• ✅ Addition/Change/Update/Fix to this project
• ✅ Testing to ensure no regression
• ✅ Automated unit/functional testing coverage
• ➖ Developer Documentation support on feature change/addition
• ➖ User Guide Documentation support on feature change/addition
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ✅ Reviewed by a human
• ✅ Code review by maintainers
• ✅ Full testing and approval
• ✅ Credit contributors
• ✅ Review with the product owner
• ✅ Update Release Notes
• ✅ Release canvas_override-1.0.0

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Fixed cache metadata in the node view and local task alters so permission changes, disabling Canvas Override on a type, and node renames invalidate cached output correctly.