Conditionally disable access to update manager routes

Problem/Motivation

As discovered in #3456128: Dynamic Page Cache uncachable on Drupal 10.3 with Admin Toolbar Tools and Update modules the UpdateManagerAccessCheck makes some pages uncacheable. In that issue catch suggested we could dynamically create the routes if the allow_authorize_operations setting is TRUE. Unfortunately this causes issues with local tasks and local actions if the routes don't exist, so they too need to be dynamically created. Instead it may be simpler to just disable access to the routes if the setting is FALSE.

Steps to reproduce

Proposed resolution

When no access is configured in settings, set all the routes to _access: FALSE, this means we don't need to do any other access checks at all on runtime - they're just denied. When access is configured, we only have to do a permissions check, not the uncacheable check based on settings. Deprecate the custom access check for removal in 12.x

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet