Issue #3626905: Installing yoyaku_manager lets an administrator reach every tenant's resources, slots, tariffs and bookings

Closes #3626905.

Installing yoyaku_manager removed the tenant boundary #3625422 draws. ManagerHooks::entityTypeAlter() gives the resource, the slot, the resource tariff, the slot tariff and the booking ResourceScopedAccessControlHandler, which extended core's EntityAccessControlHandler. Its parent then granted administer yoyaku on every row of every tenant, where the engine's YoyakuAccessControlHandler stops an administrator at the tenant the request resolves to. That handler's own docblock asks a per-resource manager grant to extend it for exactly this reason.

• ResourceScopedAccessControlHandler extends YoyakuAccessControlHandler: an administrator reaches what they reach without the module, and no more.
• A manager's per-resource grant holds only inside the current tenant too, with the yoyaku_tenant cache context the engine's answer carries.

A single-tenant site is unaffected: every row carries the one tenant the context resolves to.

Cost: none. The tenant comparison is the one the engine's handler already made, on an entity already loaded.

Test: ResourceAccessTest::testAnotherTenantsRecordsStayOutOfReach(): another tenant's resource is refused to an administrator (update, delete) and to a manager granted it, and this tenant's resource is still allowed. It fails on 1.x at the administrator's assertion, and at the manager's once the manager's tenant condition is removed.

AI-Generated: Yes (Claude Code was used to write this change, its test and this description. I reviewed them before posting.)