document that type_access() may not return TRUE

Oh hai we are ignoring your earlier result:

    // Base initial access on the user's basic permission to use this flag.
    $access = $this->user_access($action, $account);

    // Check for additional access rules provided by sub-classes.
    $child_access = $this->type_access($entity_id, $action, $account);
    if (isset($child_access)) {
      $access = $child_access;
    }

If user_access() says FALSE, and type_access() says TRUE, then SHAZAM the user gets access anyway!

Fortunately, only flag_user overrides type_access(), and it returns FALSE or NULL. So that's ok.

I am guessing that the intention is that type_access() can only deny access, not grant it. In other words, it only returns FALSE (to deny) or NULL (to say nothing). However, this needs documenting, HARD.