Provide better documentation for the `WebformHandlerInterface::access` method regarding the creation operation

Problem/Motivation

This issue was initially addressed as a security concern, but it was determined that it could be made public without risk.

The WebformHandlerInterface::access method is called when attempting to perform an operation on an existing submission or to display it.
However, this does not seem to be the case when accessing the webform itself.

I thought the "create" operation would also be handled.
Just as you get an access denied error when attempting to view a webform for which the "Create submissions" access rule does not authorize your account/role, I thought the web form would not be accessible.

I expected \Drupal\webform\Entity\WebformSubmission::access() to be called when viewing or submitting the webform, which does not seem to be the case at the moment.
This would have been similar to the behavior of an entity form, such as the node form, for example. When attempting to access /node/add/{node_type}, \Drupal\node\Entity\Node::access() is called with the "create" operation.

Steps to reproduce

1. Create a simple webform handler, implementing the WebformHandlerInterface::access method
2. Attach this handler to any existing or new webform.
3. Try displaying and submitting the webform.

Proposed resolution

In my opinion, this should at least be better documented to make sure a developer won't accidentally rely on this method to restrict access to a sensitive form.

Remaining tasks

Update the doc block for the method, or discuss further.

User interface changes

None.

API changes

None.

Data model changes

None.