Add 'access content' permission to routes in tour_example

Problem/Motivation

tour_example module doesn't demonstrate basic security best practices on its routes.

We need to change that.

In the routes.yml file, it currently says:

  requirements:
    _access: 'TRUE'

This allows anyone with access to the site to see the page, which opens up other possible security concerns.

Proposed resolution

• Change the routes.yml file to say something like this:
  

    requirements:
      _permission: 'access content'
  

• Update the tool menu test to reflect that this route is not visible to anonymous users, and *is* visible once a user with 'access content' permissions has been logged in.
• Amend any tests which use these routes to log in a user who can access them.