[hooks/security] Defer entity permission checks to an Operation.
Some of these checks may currently happen twice within the same
transaction and be costly.
This should be semantically safe. If people rely on some internal
transaction ordering to be allowed early (thus pass) while the
condition wouldn't be met at precommit time, their application is
broken. It however seems unlikely to happen in the real life (tm).
Closes #2932033
What's new in CubicWeb 3.18?
============================
New functionalities
--------------------
* add a security debugging tool
(see `#2920304 <http://www.cubicweb.org/2920304>`_)
API changes
-----------
* not really an API change, but the entity permission checks are now
systematically deferred to an operation, instead of a) trying in a
hook and b) if it failed, retrying later in an operation
Deprecation
---------------------
Deprecated Code Drops
----------------------
* ``ldapuser`` have been dropped; use ``ldapfeed`` now
(see `#2936496 <http://www.cubicweb.org/2936496>`_)