Extract CRUD permission checks into a reusable service

[ERuban]

Since 5.0.10, AssociationConfigurator checks the target controller's Crud::setEntityPermission() and Actions::setPermission() before rendering the link to the related entity. That logic is private, so third-party configurators that render links or embedded blocks pointing to another CRUD controller can't reuse it and end up copying it or duplicating permission names on the field.

This PR extracts it into a public service, CrudPermissionCheckerInterface::isGranted($context, $crudControllerFqcn, $action, ?$entityDto), used by AssociationConfigurator itself and available to any custom configurator. The per-request cache and its kernel.reset tag move along with it. No behaviour change for AssociationField.

Also adds a section to doc/security.rst and a functional test on SecuredApp for the association-link permission check (it had only unit coverage before).