Contact and relationship revision access does not require access to the entity

Problem/Motivation

Revision operations on CRM contacts and relationships are allowed based only on a global revision permission. They are not combined with view, update, or delete access on that specific entity.

Drupal core node access requires both the revision permission and access to the node (for example, view access to see a revision). CRM does not. A user who is given view crm contact revision (or the relationship equivalent) can open revision pages for contacts they are not allowed to view. Those revisions include personal data such as names and contact methods.

Affected handlers:

• Drupal\crm\Access\ContactAccessControlHandler::checkAccess() — operations view all revisions, view revision, revert, delete revision
• Drupal\crm\Access\RelationshipAccessControlHandler::checkAccess() — the same operations

Routes come from core RevisionHtmlRouteProvider, for example /crm/contact/{crm_contact}/revisions/{crm_contact_revision}/view.

Steps to reproduce

1. Create two person contacts with identifying data. Give user A view access to only the first contact (for example via mapping or bundle permissions), not the second.
2. Grant user A view crm contact revision (and not administer crm or view any crm contact).
3. As user A, visit the revision view URL for the second contact.

Proposed resolution

Mirror node access: AND the revision permission with the matching entity operation.

• view revision / view all revisions → also require view on the entity
• revert → also require update on the entity
• delete revision → also require delete on the entity (or the same rule core uses for the entity type)

Preserve cacheability by chaining AccessResult objects (andIf()) rather than converting access to a boolean.

Remaining tasks

• Update both access control handlers.
• Add kernel or functional tests for allowed and denied revision routes.

User interface changes

None, other than revision tabs/links disappearing when the user cannot view the entity.

API changes

None.

Data model changes

None.