Node reference fields can include unpublished nodes the user may view

Node reference fields have a new setting, "Include unpublished nodes the user has access to view". It is off by default, so nothing changes for existing fields.

Before, these fields only matched published nodes unless the user had the "Bypass content access control" permission. A user who was allowed to view unpublished nodes still could not reference them.

When the setting is on, the nodes a user can reference follow the permissions they already have:

• "View any unpublished content": any unpublished node.
• "View own unpublished content": their own unpublished nodes.
• Neither: published nodes only, as before.

The setting is per field, under the reference type settings. It is stored as handler_settings.include_unpublished_entities and read by NodeSelection. Other entity types are not covered yet, see #3110677: [PP-1] Referencing new media requires "administer media" permission.