Generate the permissions and the access checks of generated endpoints

Proposed resolution

• Emit a permission per generated endpoint, in a generated permissions file, with a description naming the bundle it exposes.
• Default a new endpoint to closed rather than open: a generated endpoint that nobody granted answers 403, so generating cannot publish content by accident.
• Entity access checked per entity in the base classes, including for entities reached through a card or a paragraph, and asserted for an unpublished target.
• Report on the status page which generated endpoints are reachable anonymously — the question a site owner needs answered before switching a generation on.
• Write endpoints — counters, submissions — additionally covered by the module's flood control.

Remaining tasks

Everything.