Issue #2061977 by InternetDevels, kim.pepper, ianthomas_uk, herom: Replace user_access() calls with ->hasPermission() in all core modules except user.