Programmatic form submissions don't bypass access checks by default anymore

By default, programmatic form submissions used to be processed without taking #access into account.
The new behavior is now to apply access checks by default.

Modules that rely on the old behavior need to explicitly bypass access checks by calling FormStateInterface::setProgrammedBypassAccessCheck():

$form_state = new FormState();
$form_state->setProgrammedBypassAccessCheck();
\Drupal::formBuilder()->submitForm(MyForm::class, $form_state);