Restore group-scoped administer og menu permission

While adding coverage for the site-wide permission, I hit a pre-existing access bug that becomes reachable with this change.

OgMenuInstanceAccessControlHandler overrides checkAccess() completely, which drops core's guard that forbids deleting an unsaved entity. This has existed since the handler was added, but no existing permission path granted delete access to a menu instance, so the result remained neutral and the existing test still passed.

Once the global `administer og menu` permission grants delete access, that gap becomes visible and the test fails. The MR restores the guard in the access service:

  if ($operation === 'delete' && $instance->isNew()) {
    return AccessResult::forbidden()->addCacheableDependency($cacheability);
  }

It also adds coverage for an unsaved instance that has a group, which the existing test does not exercise.

I think this is small and closely related enough to keep here, but happy to split it into a follow-up if preferred.

Added the rename to the plan in the issue summary 'administer og menu instances'

We need to cover edit/delete here too:

D7:

D10:

Progress this is the result of applying MR:

Edit: the Audience field moving up and linking is totally unrelated (if you're wondering), that was just form display config

Thanks again @claudiu.cristea for the review.

I put together a couple of quick roadmaps #3623047: [meta] 2.0.0-beta1 release roadmap and #3623048: [meta] 2.0.0 stable release roadmap