Centralize access check for formatters

The recommended practice is what ER already does: compute access in a prepareView() method in a base formatter that all (core or contrib) formatters should implement. This prepareView() sets ->access properties on each item, and then each individual formatter needs to check ->access before actually outputting an item.

Not sure how best this can be done.
- We cannot filter the list of $items in the entity, as #2078155: Access protected field items being removed showed.
- including a generic mechanism that would build a separate Field $items object, cloned from the one in the entity, and then filtered according to some $item->shouldBeDisplayed() bool method, before passing it to Formatter::view(), would add lots of overhead on all field types where this is not needed (text, number...)

File / Image formatters have the same issue (file / image fields have a 'display' property that lets users upload files but not display them, that property needs to be checked by each formatter consistently - see the pending followup in #2020677: file_field_prepare_view() should not delete items)

We now have EntityReferenceFormatterBase::getEntitiesToView(), which was added in #2346315: Translated entity references not rendered in the entity display language and gives all ER formatters a unified way of getting 'accessible' items, so I think there's not much else we can do here.