Fix/auth saving newly saved queries 11942

https://www.openproject.org/work_packages/11942

I finally got too irritated with the old retrieve_query method and have re-implemented it in a simpler way in app/controllers/api/experimental/concerns/query_loading.rb. The experimental api controllers now use this but everything else still uses the old one so hopefully i didn't break anything.

The problem was that when using retrieve_query you couldn't pass a query_id to it because it would just load the query and ignore any other params. The result was that when you save a query and then make a change to it (add a filter, whatever) the workaround was to pass the modified query as params but without its id so that the backend would pay attention to it and not just load the saved query. This approach no longer works when returning the authorised query actions because it means that modified queries appear to be new (as they have no id) which means the user isn't allowed to update them. Hence the greyed out 'Save' action.

The fix was to re-write retreive_query. Now it doesn't look to the session at all, will load the query if you give it a query_id param and then will also update any of the attributes if you pass them as params.

Note: I actually did start writing some specs for this but once i saw how much of a bummer it's going to be to get all the the correct data in there to produce meaningful meta data it just didn't seem like a good way to spend my time considering if all goes to plan we're not even going to be using this code in a month. Feel free to object, perhaps i'm being lazy.
although i think the project scope should only be set if the query has no project. there could be a public query with projectA that is being viewed from the projectB view and in that case i don't think we would want to force the scope to be projectB.