Inconsistent handling of hook_entity_create_access for config entities

Background information

• security.drupal.org private issue: https://security.drupal.org/node/183773
  (included for reference. Please do not report access denied as an error.)

This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team.

Problem/Motivation

While trying to restrict the creation of content types I noticed that hook_entity_create_access works for some config entities and not for others.

Some add form routes only check for a specific permission and don't trigger this hook.

Steps to reproduce

1. Add this hook:

/**
 * Implements hook_entity_create_access().
 */
function test_entity_create_access() {
  return AccessResult::forbidden();
}

In theory this means we can't create any entity.
2. In practice, I can still create contact forms or node types for example, but I can't create menus or text formats.

Proposed resolution

All entity create form routes should probably use the _entity_create_access requirement.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet