FIX: Server-side hashtag lookups of secure categories for a user (#19377)

* FIX: Use Category.secured(guardian) for hashtag datasource

Follow up to comments in #19219, changing the category
hashtag datasource to use Category.secured(guardian) instead
of Site.new(guardian).categories here since the latter does
more work for not much benefit, and the query time is the
same. Also eliminates some Hash -> Model back and forth
busywork. Add some more specs too.

* FIX: Server-side hashtag lookup cooking user loading

When we were using the PrettyText.options.currentUser
and parsing back and forth with JSON for the hashtag
lookups server-side, we had a bug where the user's
secure categories were not loaded since we never actually
loaded a User model from the database, only parsed it
from JSON.

This commit fixes the issue by instead using the
PretyText.options.userId and looking up the user directly
from the database when calling hashtag_lookup via the
PrettyText::Helpers code when cooking server-side. Added
the missing spec to check for this as well.

lib/pretty_text.rb

@@ -225,6 +225,12 @@ module PrettyText
 
       if opts[:user_id]
         buffer << "__optInput.userId = #{opts[:user_id].to_i};\n"
+
+        # NOTE: If using this for server-side cooking you will end up
+        # with a Hash once it is passed to a PrettyText::Helper. If
+        # you use that hash to instanciate a User model, you will want to do
+        # user.reload before accessing data on this parsed User, otherwise
+        # AR relations will not be loaded.
         buffer << "__optInput.currentUser = #{User.find(opts[:user_id]).to_json}\n"
       end