checkAccess is not being called in entity reference fields (3.x)

Hi all,

I'm facing an issue with Access handlers. In my use case, I'm overriding `NodeAccessControlHandler::checkAccess` to add some requirements to allow/deny access to a specific content type.

For context, I have a job node that references a virtual experience node.

When viewing the job via CMS UI (`/node/{nid}`), the `checkAccess` is called when `$node->bundle() = job` and `$node->bundle() = virtual_experience`.
However, when I execute the GraphQL query below (via postman or via graphiql, the `checkAccess` is only called for `$node->bundle = job` and the virtual experience content is returned even if the user does not have permission (`AccessResult:forbidden`) to view it.

query:
```{
nodeById(id: "50685") {
entityId
title
... on NodeJob {
fieldVirtualExperience {
entity {
... on NodeVirtualExperience {
fieldOverview {
processed
}
}
}
}
}
}
}
```

While researching this issue, I found this PR: https://github.com/drupal-graphql/graphql/pull/879 but not sure if it's the fix for the issue I'm facing.

I'm happy to work on this and submit a PR, just need some guidance on what's the best approach here.

Thanks,
Carol