Disallow deleting an XB-enabled content entity if it's currently the homepage

Overview

Currently XB is only enabled for the Page content entity type and the article bundle of the Node content entity type. #3498525: [META] Allow Canvas to be used on any content entity type (bundle), as long as it has certain entity type characteristics will generalize that.

Hence we need a generic solution to what @lauriii described at #3503412-16: Allow Content Author to set site's homepage from navigator:

We should not allow deleting the home page. User would have to assign another page as a home page before they could delete it. I'll let you decide if we should implement that here or in another issue.

Proposed resolution

1. Implement hook_entity_access() to disallow deletion of the given entity if it's currently the homepage (either as its canonical entity route or as its alias).
   (Note that this automatically causes the Drupal admin UI to respect this everywhere, thanks to \Drupal\Core\Entity\EntityListBuilder::getDefaultOperations() checking $entity->access('delete').)
2. Expand XbContentEntityHttpApiTest::testDelete setting up a new page, marking it as homepage, and verifying that the user don't see the delete-form operation and cannot delete it. After granting the 'bypass node access' permission, the operation should appear and it could be deleted.
   IOW: verify that ApiContentControllers::list() (/xb/api/content/…) doesn't include the delete-form operation for the homepage, this allows the client to see the result of the "entity operations" hook, aka the result of \Drupal\experience_builder\Controller\ApiContentControllers::getEntityOperations() and \Drupal\Core\Entity\EntityListBuilderInterface::getOperations()..

⚠️ Users with elevated permissions would still be able to bypass this for some content entity types, such as Node:

    // Only bypass if not a revision operation, to retain compatibility.
    if ($account->hasPermission('bypass node access') && !isset(static::REVISION_OPERATION_MAP[$operation])) {
      $result = AccessResult::allowed()->cachePerPermissions();
      return $return_as_object ? $result : $result->isAllowed();
    }

Out of scope: updating the React UI to only show available operations.

User interface changes

• The Delete page operation in the XB UI for Page entities will not appear if the current page is the homepage
• The Delete operation will also not appear in Drupal admin UIs for relevant content entities.