_salesforce_fieldmap_access() fails to check permissions

/admin/settings/salesforce/fieldmap/%/edit and friends are accessible by any user (including anonymous), as the access callback function _salesforce_fieldmap_access() does not do any permission checking - it only checks whether the fieldmap name is valid.

This is critical as it means any user can edit or delete fieldmaps without permission, although mitigated by the fact the user has to know the precise fieldmap name to be able to exploit it (the fieldmap list is properly protected).