Base access checks on embed buttons instead of filter formats

d.o issue: https://www.drupal.org/node/2362897
Tests are not failing because we're not actually using `admin` permissions anywhere. Since for add/edit routes, _permission is used and not _entity_access, I don't think this needs to be changed.

The admin permissions should be required only when we use something like `embed_button.admin` for a more fine grain permissions and not as of now. Am I correct here?