Add "bypass blocked pdf uploads" permission

Problem/Motivation

When block_failed_uploads is enabled, it applies globally to all users. There is no way for site administrators to allow trusted roles (e.g., administrators or senior editors) to upload non-compliant PDFs when needed, while still enforcing checks for less trusted roles.

This is a common real-world need: organizations may receive legacy documents or third-party PDFs that cannot be remediated before upload. Currently, the only options are to either block everyone or warn everyone — there is no middle ground.

Steps to reproduce

1. Go to Administration > Configuration > Media > PDF Accessibility (/admin/config/media/pdf-accessibility).
2. Enable "Check on upload" and "Block uploads that fail accessibility checks."
3. Log in as any user (including an administrator) and attempt to upload a PDF that fails accessibility checks.
4. The upload is blocked with no way to override, regardless of the user's role or permissions.

Proposed resolution

Add a new bypass blocked pdf uploads permission (restricted). This follows established Drupal patterns like bypass node access and bypass content lock.

In Pdfa11yConstraintValidator::validate(), before blocking an upload, check whether the current user has this permission. If they do, treat the upload as warn-only (show warnings but allow saving), even when block_failed_uploads is true.

Accessibility checks still run and results are stored regardless of whether the user has the bypass permission. The permission only affects whether a failed check blocks the upload.

Remaining tasks

• Add the permission to pdfa11y.permissions.yml with restrict access: true
• Update Pdfa11yConstraintValidator::validate() to check the permission before blocking
• Add test coverage
• Review
• Merge

User interface changes

A new "Bypass blocked PDF uploads" permission appears on the permissions page. No other UI changes.

API changes

None.

Data model changes

None.