Access permissions 4: Fix user caching

[lukasbestle]

🚨 Merge first

• Access permissions 3: Smaller refactorings #6879

Description

Summary of changes

No longer cache the user object in each ModelPermissions instance

Reasoning

Made the permission checks return stale results if the user changed during the request; this made the additional permission caching in the $page/file->isAccessible() and $page/file->isListable() methods useless.

Changelog

Fixes

• Permissions are now correctly determined if the active user changes during the request

Breaking changes

• Classes extending ModelPermissions need to use the user() method instead of $user and $permissions properties

Docs

None

Ready?

• In-code documentation (wherever needed)
• Unit tests for fixed bug/feature
• Tests and CI checks all pass

For review team

• Add lab and/or sandbox examples (wherever helpful)
• Add changes & docs to release notes draft in Notion

[distantnative]

@lukasbestle Do you have an idea how much of a performance impact this has? Since if we don't cache the ModelPermission objects, each time they now have to be created the blueprint is also read (which has been a performance bottleneck for us).

[lukasbestle]

There are two components to this:

• At the moment we don't cache the ModelPermissions objects at all. E.g. $page->permissions() creates an instance each time. Which means that the user object is retrieved each time a permission is checked (before: in the constructor of ModelPermissions; after: when actually checking the permission). So in practice this PR alone does not create any difference. Only if we ever reuse an existing ModelPermissions object for additional checks, this becomes a difference. But there I would say security > performance. Viewed from the opposite perspective: With this PR, it becomes practical for the first time to cache the ModelPermissions object without security impact, thus allowing us to read the blueprint only once (per model).
• We have another layer of caching for access/list permissions, which are those that are commonly checked more than once per request. All the other permissions are only checked for a particular action, of which not many happen per request.