Base access checks on embed buttons instead of filter formats

d.o issue: https://www.drupal.org/node/2362897
Maybe include "entity embed" or so in the permission name, to make it a bit clearer to which module it belongs (and prevent clashes)