Decorate the Group module's access handler for /group/#/latest routes

Problem/Motivation

When using Group with Content Moderation, the Access Unpublished tokens don't work for granting access to the /group/#/latest route (i.e., a new draft of an already published group).

Normally, AU supports the /latest route on moderated entities just fine. Access to that route is controlled by '_content_moderation_latest_version', which is handled by the 'access_check.latest_revision' service. AU decorates that service with its own 'access_unpublished.access_check.latest_revision' service to provide the token logic.

However, for Group entities, GroupLatestRevisionRouteSubscriber removes '_content_moderation_latest_version' and replaces it with its own '_group_latest_revision' access handler, implemented by the 'access_check.group_latest_revision' service. Thus, AU's decorator never comes into play.

Steps to reproduce

1. Install Content Moderation, Group, Access Unpublished, and Access Unpublished Group.
2. Set up a group type and permissions, etc. as normal for AU/AUG.
3. Configure the group type to use the Editorial workflow.
4. Create a group and save it as published.
5. Edit the group and save your changes as a draft.
6. Edit the group again and create an AU token.
7. Copy the token, then paste it into the URL of an anonymous browser session.

Expected result: The group page loads for the anonymous user with the tokenized URL. Removing the token from the URL yields Access Denied.
Actual result: The anonymous user gets Access Denied even with the tokenized URL.

Proposed resolution

We can fix this by decorating the 'access_check.group_latest_revision' service to add token handling.

API changes

Adds an 'access_unpublished.access_check.group_latest_revision' service that decorates 'access_check.group_latest_revision'.