We're about to split up access checks into those which are specific to
references and those which are specific to all changed objects. This
requires some refactoring on our side where we not only iterate over all
changes separately, but also where we do another batched check for all
objects introduced via all changes at once.

To ease the transition, refactor the access checks into their own
function. This allows us to more easily handle timeouts across both
kinds of checks.