Improve permissions

1) The admin views for stores and products need to use the "access $entity_type overview", not "administer $entity_type". This was already fixed for orders and carts.

2) Config entity types should not get an "overview permission".

3) Adding a product as an authenticated user with a "create own" permission doesn't allow variation creation. Same with order items. We need to create access control handlers for variations and order items that always return TRUE, thus relying on the parent access control (since these entities can't exist without the parent).