Allow access requests for new records by default

* through a service component, because the deposit form defaults would
  be set under `record.metadata.[...]` which is invalid
* the `access` API endpoint and the share modal only become active once
  the draft has been created, so the `create` hook should indeed be the
  first spot where the access settings are available