Fix access result cache tags in ReferencedEntityAccessControlHandler::checkAccess()

Problem/Motivation

ReferencedEntityAccessControlHandler has two correctness problems related to cache metadata and access result semantics.

1. checkAccess() returns AccessResult::allowed() with no cache tags.

When a parent entity grants access, the result is returned without attaching any cacheable dependency. The cached access result is therefore never invalidated when the parent entity changes (e.g. is unpublished, deleted, or reassigned). Any page that renders a subentity may serve stale access decisions until the cache is manually cleared.

// Current — cache tags from the parent entity are never attached.
if ($entity_parent->access($operation)) {
  return AccessResult::allowed();
}

Fix: add the parent entity and the subentity itself as cacheable dependencies.

if ($entity_parent->access($operation)) {
  return AccessResult::allowed()
    ->addCacheableDependency($entity_parent)
    ->addCacheableDependency($entity);
}

2. checkCreateAccess() returns AccessResult::forbidden() instead of AccessResult::neutral().

When no referencing field is found for the given bundle, forbidden() is returned. This hard-blocks any other access control handler or hook_entity_create_access() from granting access, including the superadmin bypass. The correct return value when this handler has no opinion is neutral().

// Current — hard-blocks other access control mechanisms.
return AccessResult::forbidden();

// Fix — defers to other handlers.
return AccessResult::neutral();

Remaining tasks

• Add addCacheableDependency() calls on the AccessResult::allowed() return incheckAccess().
• Replace AccessResult::forbidden() with AccessResult::neutral() incheckCreateAccess().
• Add a kernel test covering cache tag propagation and the neutral fallback incheckCreateAccess().