Identity-aware mint: require host field view and nested parent view (including User hosts)

Problem/Motivation

Identity-aware mint currently checks file download access and view access on each referencing host entity. That is too coarse for two common cases:

1. The host is a user entity. A different account that can see some users must still be denied a mint for a file attached to someone else's account.
2. The usage host is a child entity (for example a paragraph) that holds the file field. View access on the child is not enough; the parent entity the visitor is actually authorized against must be checked as well.
3. View access on the host entity is not enough if the referencing field is denied (field-level access). A grant must not skip that deny.

A gated file with no resolvable host should also fail closed under identity mint: there is no entity to authorize against.

Steps to reproduce

1. Gate a private file field on the User entity. Attach a file to user A. Identity-mint as user B (no administer-users). Expected: 403. Without the host/field checks this can succeed if core file download access is granted.
2. Gate a private file field on a child entity that implements getParentEntity() (paragraphs). Identity-mint as an account that can view the child but not the parent. Expected: 403.
3. Deny view on the referencing field via hook_entity_field_access() while still allowing host entity view. Identity-mint as that account. Expected: 403.

Proposed resolution

When an acting account is present on mint, require all of:

1. File download access.
2. View access on every referencing host (including a user host).
3. View access on the referencing field.
4. View access on each getParentEntity() ancestor (duck-typed so File Gate does not depend on Paragraphs).

Refuse identity mint when the file has no resolvable host.

Remaining tasks

• Land the kernel tests (user host own vs other; field-view deny) and parent-walker coverage.
• Review the mint 403 copy (no extra disclosure).

User interface changes

None.

API changes

Identity-aware mint becomes stricter (fail closed) for user hosts, field-level denials, nested parents, and hostless files. Callers that already passed a correct acting account and had view on the real parent are unchanged.

Data model changes

None.