(core) Fixes persistence of the aclAsUser_ parameters across navigation

Summary:
  - The parameter was inadvertently removed by userOverrideParams().
  - when passed a function to `urlState().setHref(...)` or `urlState().makeUrl(...)` it is important that the function does not mutate the state that it receives as argument.

Link to the related task: https://gristlabs.getgrist.com/doc/check-ins/p/5#a1.s9.r791.c19

Test Plan: Adds test of the persistence by slightly modifying existing nbrowser/AccessRules2 tests.

Reviewers: paulfitz

Reviewed By: paulfitz

Subscribers: paulfitz

Differential Revision: https://phab.getgrist.com/D2820

app/client/lib/UrlState.ts

@@ -95,7 +95,7 @@ export class UrlState<IUrlState extends object> extends Disposable {
    *
    * If urlState is an object (such as IGristUrlState), it gets merged with previous state
    * according to rules (in gristUrlState's updateState). Alternatively, it can be a function that
-   * takes previous state and returns the new one.
+   * takes previous state and returns the new one (without mutating the previous state).
    */
   public makeUrl(urlState: IUrlState|UpdateFunc<IUrlState>, use: UseCB = unwrap): string {
     const fullState = this._mergeState(use(this.state), urlState);