Cached 403 for unpublished content ignores valid auHash token on subsequent requests

Problem/Motivation

When using decoupled_router, a request to /router/translate-path for an unpublished entity without an auHash token caches a 403 response. A subsequent request with a valid token still returns the cached 403 — hook_entity_access is never invoked and the token is never validated.

This is a regression introduced by commit 15b623a0 in #3535306. That commit moved the url.query_args:<hash_key> cache context declaration to after the early exit for a missing token. Because the context is never added when no token is present, the cache stores the 403 without varying by the token parameter — so requests with and without a valid token share the same cache entry.

Steps to reproduce

1. Create an unpublished node and generate a valid auHash access token for it.
2. GET /router/translate-path?path=<unpublished-node>&_format=json → 403 (expected, and now cached).
3. GET /router/translate-path?path=<unpublished-node>&_format=json&auHash=<valid-token> → 403 (bug — served from cache).
4. Clear caches, repeat step 3 → 200 (confirms caching is the cause).

Note: accessing the unpublished node URL directly (/node/123?auHash=...) works correctly. The issue is specific to the decoupled_router translate-path endpoint, or maybe also valid for endpoints provided by other modules.

Proposed resolution

In access_unpublished_entity_access(), move $config load and $result construction (which carries the url.query_args:<hash_key> cache context) to before the early exits for missing token and missing permission. Both early exits return $result instead of a bare AccessResult::neutral().