Users denied access to view a node can still access the node's Revisions page and revisions list

Problem/Motivation

This was originally reported as a private security issue but cleared by the security team for a public issue

A user with the View all revisions or [bundle]: View revisions permissions can access the Revisions page for a Node and see all revisions listed even when they DO NOT have access to view the Node.

Should they? The description associated with these permissions states To view a revision, you also need permission to view the content item. I am assuming this should also apply to the Revisions page and list?

The date and author of all revisions, along with the node title, are listed on the Node Revisions page. Although this info is relatively mundane it could be compromising depending on the context and what info is included in the title.

Steps to reproduce

1. Perform a fresh install of Drupal 10.5.2
2. Check the Content editor role has the View all revisions permission. They should by default.
3. Create a new user and assign then the Content editor role. The new user's ID should be 2.
4. Create an Article Node. The new node's ID should be 1.
5. Edit the node to create another revision.
6. Create a custom module that contains a Hook class with the following node_access hook which will deny User ID 2 (the user just created) from viewing Node ID 1.

/**
 * Implements hook_ENTITY_TYPE_access().
 */
function node_access_test_node_access(NodeInterface $node, $operation, AccountInterface $account): AccessResultInterface {
  // Hide Node ID 1 from User ID 2.
  if ($operation === 'view' && (int) $node->id() === 1 && (int) $account->id() === 2) {
    return AccessResult::forbidden()->setCacheMaxAge(0);
  }
  // No opinion.
  return AccessResult::neutral()->setCacheMaxAge(0);
}

7. Enable the custom module.
8. Login as the new Content editor user.
9. Visit the node view page (e.g. /node/1) -> Access should be correctly denied.
10. Visit a specific node revision (e.g. /node/1/revisions/1/view) -> Access should be correctly denied.
11. Visit the node's Revisions page (e.g. /node/1/revisions) -> Access is allowed and the date and author of all revisions, along with the node title, are listed.
12. Edit permission and remove the View all revisions permission and given the Article: View revisions to the Content editor role.
13. Clear site cache.
14. Visit the node's Revisions page (e.g. /node/1/revisions) -> Access is allowed and the date and author of all revisions, along with the node title, are listed.

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet