checkUserSubmissionsAccess doesn't check access for the user account in the URL parameter

Problem/Motivation

WebformAccountAccess::checkUserSubmissionsAccess() does not sufficiently check whether the account to run access checks for actually matches the user account in the URL parameter. When the permission "Access the webform user submission page" is provided for authenticated users, it allows them to access their submissions from a URL containing a different user ID.

While it doesn't allow a user to see the other persons submissions, it does change the page title to show this other users display name. This should return access denied.

Steps to reproduce

1. Create an authenticated user account
2. Provide "Access the webform user submission page" permission to the authenticated user account
3. Login as the authenticated user and access submissions tab
4. Update user ID in URL from current user to another user (such as 1)
5. The current users submissions will show however the page title (depending on configuration/code) will show the display name for the user account matching the ID in the URL.

Proposed resolution

Pass the $user URL parameter to the custom access callback and check the account ID matches the user ID. Removing the check for the current user ID and the account ID. So it should look like this:

public static function checkUserSubmissionsAccess(AccountInterface $account, UserInterface $user) {
    $condition = ($account->hasPermission('administer webform') || $account->hasPermission('administer webform submission') || $account->hasPermission('view any webform submission'))
      || ($account->hasPermission('access webform submission user') && $user->id() === $account->id());
    return AccessResult::allowedIf($condition)->cachePerPermissions();
  }

Remaining tasks

User interface changes

API changes

Data model changes