And a lot more. Fleshed out some services.

This is the same concept as the fillpdf_file_context table in D7. It
lets the module
store generation info for generated PDFs so that private storage access
checking
can work properly. I'll be simplifying this a lot in D8 and simply
storing a
URL that I can parse to get the entities whose access needs to be
checked. And
I might backport that to D7; it's much simpler.