Custom access checks can disallow moving blocks in layout builder but the UI does not respect this

Problem/Motivation

Custom access checks can be added for operations in the layout builder either via custom code or via contrib modules like https://www.drupal.org/project/layout_builder_perms. In this way it is also possible to disallow moving blocks. In an advance use case it can be desirable to disallow blocks of a certain type into sections with a certain layout. This works fine but the layout builder UI does not respect the access on routes involved. This can lead to a situation in which the layout builder UI shows a move operation as successful (i.e. the block is move to another region in another section) but the ajax call to actually register the change resulted in a 403. The user will not notice this until reloading the page or saving the layout. Only then they will discover that the block was not moved.

Steps to reproduce

* Install Drupal, enable layout builder and create a layout builder enabled content type.
* Install Layout Builder Advanced Permissions (https://www.drupal.org/project/layout_builder_perms) and enable the Layout Builder Advanced Permissions Layout sub module.
* Create a custom role and configure permissions to allow the role to place blocks in sections with a layout of a certain type but not in sections with a layout of another type.
* Create a node of a layout builder enabled content type.
* Add a section (A) in the layout builder and configure it with a layout in which the custom role is allowed to place blocks.
* Add a section (B) in the layout builder and configure it with a layout in which the custom role is not allowed to place blocks.
* Add a block in section A.
* Save the layout.
* Go back to the layout builder and move the block from section A and section B. The layout builder will visually allow this and move the block to section B.
* Save the layout.
* See that the block is still in section A.

Proposed resolution

In core/modules/layout_builder/js/layout-builder.es6.js there is a behavior layoutBuilderBlockDrag. The Sortable that is created in this behavior can be extended with an onMove() callback. This callback is executed every time a block is dragged over a region. Returning false from this callback will disallow drop in that region. It will also prevent the region from being highlighted.

For this to work we will also need to add a URL that can be called via ajax and that only executes the access check for the layout_builder.move_block route and return the result (without actually executing the logic in the controller linked to the route).

Remaining tasks

- Create patch
- Review patch
- Commit patch

User interface changes

Block operations in layout builder that are not allowed will not be possible anymore in the layout builder UI.

API changes

N/A

Data model changes

N/A

Release notes snippet

TBD