Use entity access API for checking access to private files

1) Core handles file access for files attached to entities and makes it easier for entities to control access to their files using hook_file_download_access_alter(). Anything else can be done by implementing hook_file_download() yourself. This hook is currently based on the path. I guess this would be replaced with an hook_file_access() implementation that acts on the file entity if we move this into the

2) Yes. file_file_download() implements it so that access is granted if the user is able to view the file if any of those references grant access. The current implementation already checks the field access API, we just need to replace all the hook_file_download_access() with a single $entity->access('view'), as earlier patches of mine did in the referenced issue. If for whatever reason that assumption is *not* true, there's still the possibly to interfere by implementing hook_file_download($uri) (now) or hook_file_access($file) (if we replace it using an access controller), just requires a bit more code.

Fact is that most entities are *not* implementing this hook, which means that private files attached to them are *not* visible. This still includes terms in 7.x as the related issue has not yet been backported. The suggested default assumption is going to solve 99% of the use cases without additional code for entity types.

The main problem to move this into the access controller is the weird $field_type stuff, that limits all this logic to a single field type (defaults to file and then image calls this hook again using it's own field type). I'm not sure why we need this nor if is actually working, if you look at file_get_file_references(), you can see that there is a loop that overrides the $field_type argument.