Problem/Motivation
#2351777: RouteBuilder security model: wishful thinking would like to inject the router.builder service into access_manager but this leads to a circular dependency: access_manager -> route.provider -> router.bouilder
Proposed resolution
Separate the loading of checks out of AccessManager. Now we can inject this check provider service into both access manager and access subscriber or router.builder when they get merged into one. Circular dependency broken.
The separation is nice. For example, we could remove four setContainer calls from the access manager test and easily/mechanically convert the rest of the test by just moving the relevant calls from AccessManager to the checkProvider.
Remaining tasks
If we were passing $request all along then getChecksNeedRequest would be removable. Do we want to do that? The current way is simpler. Removing getChecksNeedRequest would be slightly nicer.
User interface changes
API changes
setChecks and addCheckService is removed from AccessManager. The only service holding them becomes private. This is a good thing as there is no reason to call them.
