Allow access requests for new records by default

• through a service component, because the deposit form defaults would be set under record.metadata.[...] which is invalid
• the access API endpoint and the share modal only become active once the draft has been created, so the create hook should indeed be the first spot where the access settings are available