Replace runtime route provider with RouteSubscriber + pure YAML; add access checks and tests

Problem/Motivation
The module currently mixes YAML routes (myrest_seo.routing.yml) and a custom route provider (src/Routing/MyrestSeoRoutes.php). Mixing approaches complicates maintenance, testing, and access control. We should standardize routing and ensure proper permissions and cache metadata.
Proposed resolution
•
Move all routes to myrest_seo.routing.yml where possible.
•
If any dynamic alterations are needed, use a RouteSubscriber (src/EventSubscriber/RouteSubscriber.php) instead of a custom route provider class.
•
Ensure each route has explicit requirements: _permission: 'administer myrest_seo' (or specific access checks if applicable).
•
Add cacheability where relevant (for controllers): cache contexts/tags/max-age.
•
Add tests: one Functional test validating routes exist and are accessible to a user with permission; verify 403 for users without permission.
Tasks
•
[ ] Remove src/Routing/MyrestSeoRoutes.php and migrate its routes to YAML.
•
[ ] Add src/EventSubscriber/RouteSubscriber.php only if we still need to tweak existing routes.
•
[ ] Audit myrest_seo.routing.yml for complete _permission/_access requirements.
•
[ ] Update myrest_seo.links.menu.yml if route names/paths changed.
•
[ ] Add Functional test for route availability and access control.
•
[ ] Ensure CI (PHPCS/phpstan-drupal) stays green.
Acceptance criteria
•
[ ] No custom route provider remains; routes are YAML-based (with RouteSubscriber only if necessary).
•
[ ] All admin routes require explicit permissions and return 403 to non-privileged users.
•
[ ] Functional test passes and confirms routes/access.
•
[ ] CI green (PHPCS/phpstan-drupal).
BC/Risk
•
Low. Route names should remain stable; if any change is required, provide an update note in README/CHANGELOG.