Bypass workspace access permission is not working as expected

Note the unnecessary use of he in this comment is being tackled in #2286655: Gender neutral language

Committed 6253899 and pushed to 8.8.x. Thanks!
Committed a54ef47 and pushed to 8.7.x. Thanks!

I discussed this a bit with @Wim Leers and we agreed that since this is access it's important the code is clear whats happening so something like

diff --git a/core/modules/workspaces/src/EntityAccess.php b/core/modules/workspaces/src/EntityAccess.php
index 96b32472be..2fb7762b86 100644
--- a/core/modules/workspaces/src/EntityAccess.php
+++ b/core/modules/workspaces/src/EntityAccess.php
@@ -124,8 +124,10 @@ protected function bypassAccessResult(AccountInterface $account) {
     // to ALL THE THINGS! That's why this is a dangerous permission.
     $active_workspace = $this->workspaceManager->getActiveWorkspace();
 
-    return AccessResult::allowedIf($active_workspace->getOwnerId() == $account->id())->cachePerUser()->addCacheableDependency($active_workspace)
-      ->orIf(AccessResult::allowedIfHasPermission($account, 'bypass entity access own workspace'));
+    $owner_has_access = AccessResult::allowedIf($active_workspace->getOwnerId() == $account->id())
+      ->cachePerUser()->addCacheableDependency($active_workspace);
+    $access_bypass = AccessResult::allowedIfHasPermission($account, 'bypass entity access own workspace');
+    return $owner_has_access->orIf($access_bypass);
   }
 
 }

is preferable because it makes it clear where the or is happening and that cacheability is dealt with correctly. I've made this change on commit.

Also I think we should add a test case that access is denied - so something like

    // Create a new user that should be able to edit anything in the Bears
    // workspace.
    $a_n_other = $this->drupalCreateUser(['view any workspace']);
    $this->drupalLogin($a_n_other);
    $this->switchToWorkspace($bears);

    // Editor 3 should be able view but not create and edit.
    $this->drupalGet('/node/' . $ditka_bears_node_id . '/edit');
    $this->assertSession()->statusCodeEquals(403);
    $this->drupalGet('/node/' . $ditka_bears_node_id);
    $this->assertSession()->statusCodeEquals(200);

Ahhh!!! We already have coverage of this in \Drupal\Tests\workspaces\Functional\WorkspacePermissionsTest::testEditOwnWorkspace. So let's not do that here.

I think we should open a follow-up to consider merging the test with \Drupal\Tests\workspaces\Functional\WorkspaceViewTest and \Drupal\Tests\workspaces\Functional\WorkspacePermissionsTest as then it easier to spot holes in our coverage.