JSON:API FileUpload::checkFileUploadAccess() should pass the field item list to field access checks for existing entities

This was originally reported as a private security issue but cleared by the security team for a public issue

Problem/Motivation

Drupal’s JSON:API existing-resource file upload route checks access against the field definition, not the actual field item on the target entity.
On sites that use entity-specific or field-item-specific access rules, a user who can update an entity can upload and attach a file to a protected file field even when normal field edit access denies the file upload.

When we upload file to an existing endpoint (POST /jsonapi/{entity_type}/{bundle}/{uuid}/{file_field_name}), FileUpload::checkFileUploadAccess() checks field access with only with `$field_definition`:

$field_access_result = $entity_access_control_handler->fieldAccess('edit', $field_definition, NULL, NULL, TRUE);

Because of that, hook_entity_field_access() implementations and access control handlers aren't considered in the access validation.

Steps to reproduce

• Enable JSON:API module and file upload access
• Create a content type with a file field, for example field_private_file.
• Implement hook_entity_field_access() for a file "field_private_file" field so the result depends on some permission
• Validate the access check
• Notice that our hook implementation is not invoked and access is not restricted

Proposed resolution

For existing entities, check access on the field item list:

$field_access_result = $entity
  ? $entity->get($field_definition->getName())->access('edit', $account, TRUE)
  : $entity_access_control_handler->fieldAccess('edit', $field_definition, NULL, NULL, TRUE);

Remaining tasks

- Fix
- Add tests

User interface changes

N/A

Introduced terminology

N/A

API changes

Data model changes

Release notes snippet