referenced users output with the 'Label' formatter are not shown to users without the 'view user profiles' permission

The problem is here:

  // Rebuild the items list to contain only those with access.
  foreach ($items as $key => $item) {
    if (empty($item['access'])) {
      unset($items[$key]);
    }
  }

$item['access'] was set by checking entity_access('view', ...). Which tells you if you can see an entity. But for user entities the rules are slightly different -- if you can't view the user, you can still view the username (= the label).

Well this is ugly. Though not quite as ugly as I feared.

In this patch, I'm:

a. moving the skipping of items with no access to each formatter's loop. On the plus side, this saves us a foreach loop! :)
b. for the 'label' formatter, only do the skipping for non-user target entities
c. expand the code for determining whether or not to show a link (which is a good thing too IMO -- it was a pretty dense line of code!)
d. for user target entities, override the displaying of a link if the user had no permission. Because for users we skipped the skipping in b, this falls back to showing the username, which is the expected behaviour.

Thanks for reviewing everyone!

I think this can go to RTBC.

This would be covered by #1984130: referenced users output with the 'Label' formatter are not shown to users without the 'view user profiles' permission.