Allow views with arguments to specify they aren't provided by the URL

Problem/Motivation

Asked if this issue existed in slack, and was told it was reported privately against a contrib module but decided that it could be a public hardening in views. So this is partly my original report, partly the security hardening aspect.

Views arguments can be passed directly to displays via the views render element 'arguments' key. This allows callers to specify the exact arguments that will get sent.

However, ArgumentPluginBase always does this:

// By definition arguments depends on the URL.
    // @todo Once contexts are properly injected into block views we could pull
    //   the information from there.
    $contexts[] = 'url';

This is because arguments may or may not come from the URL after all.

I think we need some kind of setting to say that we're definitely going to be passing the arguments by hand, then we can disable this cache context and also prevent arguments being passed from the URL.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet