Add test coverage for "Preserve hidden grants" option

Add some test coverage for "Preserve hidden grants" option to make sure it works correctly, after #2140819: "Preserve hidden grants" setting ignored is resolved.

How to test: Human edition

All steps are "as admin" unless otherwise specified.

Test "preserve hidden grants" enabled

1. (Prerequisite -- enable "preserve hidden grants" -- admin/config/people/nodeaccess -- it's enabled by default.)
2. Create a user role, i.e. "testrole".
3. Create a user account, i.e. "authuser," and give them no roles (i.e. "authenticated user").
4. Create a user account, i.e. "testuser," and give them role "testrole".
5. On the nodeaccess settings page (admin/config/people/nodeaccess):
   1. (optional) For simplicity, in the "Allowed grants" fieldset, enable only the View grant (i.e. disable Edit and Delete).
   2. In the "Allowed roles" fieldset, enable anonymous and testrole.
      1. This ^^ setting controls which roles appear on the "Grant" tab of each Article node -- i.e. you can customize/override grants on a per-node basis for these roles.
   3. In the "Content type grant access" fieldset, enable the tab for a content type, i.e. "article."
      1. This ^^ setting enables the "Grant" tab on Article nodes -- i.e. allows you to customize grants on a per-node basis for this content type.
   4. In the next section, expand the fieldset for "Article", and grant "view" permissions to anonymous, authenticated, and testrole.
      1. These ^^ will be the default grants settings for each role, for the Article ctype.
   5. Save the nodeaccess settings ("Save Grants" button).
6. Rebuild permissions.
7. Create two article nodes (i.e. Article One, Article Two).
8. Try to view these two articles as anonymous, testuser, and authuser. Expected results:
   1. Anonymous: has view access
   2. testuser: has view access
   3. authuser: has view access
9. On "Article One," go to the Grant tab (node/%/grant), and disable "view" access for anonymous.
   1. Notice that only anonymous and testrole are listed on the Grant tab -- i.e. the roles enabled in "Allowed roles", step 5.2.
10. Try to view Article One as anonymous, testuser, and authuser. Expected results:
    1. Anonymous: access denied
    2. testuser: has view access
    3. authuser: has view access
       1. ...because: of the "view" grant set in step 5.4 -- even though this role/grant is "hidden" from the Grant tab on Article One;
       2. ...and because "Preserve hidden grants" is enabled.

Test "preserve hidden grants" disabled

Modify the aforementioned steps as follows:

• In step 1: Disable "preserve hidden grants" -- admin/config/people/nodeaccess
• In step 8: Expected results are:
  1. Anonymous: has view access
  2. testuser: has view access
  3. authuser: access denied
• In step 10: Expected results are:
  1. Anonymous: access denied
  2. testuser: has view access
  3. authuser: access denied