Private Messages block renders for anonymous users and users without the messaging permission

Problem/Motivation

PrivateMessagesBlock (src/Plugin/Block/PrivateMessagesBlock.php) builds a "Private Messages" block (privatemsg_block) with internal links to /messages and /messages/new, but defines no blockAccess(). Block access therefore defaults to "allowed for everyone", so the block renders for anonymous visitors and for logged-in users without the privatemsg write messages permission — exposing messaging entry points to users who cannot (or should not)
use them.

The content itself is harmless (just links), but it leaks private-messaging UI to the wrong audiences and contradicts the module's own permission model: PrivatemsgMessageForm already throws NotFoundHttpException for users without privatemsg write messages, so the block's "New message" link is dead weight for those users.

Steps to reproduce

1. Enable the module and place the privatemsg_block in a region (the existing PrivatemsgBlockTest::testBlock already does this).
2. Visit any page as an anonymous user, or as a logged-in user without the privatemsg write messages permission.
3. The block (with "All messages" and "New message" links) is rendered.

Proposed resolution

Add a blockAccess() override to PrivateMessagesBlock that requires the privatemsg write messages permission:

/**
 * {@inheritdoc}
 */
public function blockAccess(AccountInterface $account) {
  return $account->hasPermission('privatemsg write messages')
    ? AccessResult::allowed()
    : AccessResult::forbidden();
}

This gates the block at the block-access layer (using Drupal's standard AccessResult), so it is hidden for anonymous users and for authenticated users without the permission, while remaining visible to users who can actually use private messaging. No template or configuration changes are needed.

Remaining tasks

Patch with tests is forthcoming.