Legal API: when auth'ing a call, should validate Account ID

Example:
1. go to Auth Web and log in (eg, BCREG0001)
2. observe that the first account is set (eg, asdfsd3333)
3. change to another account (eg, Orange and Apple Inc)
4. from My Business Registry, open an entity (eg, https://dev.bcregistry.ca/business/CP0001311)
5. observe that the current account is unchanged (as above)
6. in another tab, copy-paste the same entity's URL (as above)
7. observe that the current account has been reset to the first account (eg, asdfsd3333), which is incorrect
8. observe that the entity dashboard loads successfully, which is incorrect

The issue in step 7 will be resolved in #10880.

The issue in step 8 is the subject of THIS ticket. When a call is made to the Legal API, the authentication/authorization step should validate the account ID -- the wrong account should not be able to access an entity's data (even though it's the same user in both cases).

I am not sure about the priority of this ticket. On the one hand, it should only happen when a user enters the URL manually (or restores a bookmark). Also, this issue has existed for some time. On the other hand, it may be serious that the wrong account is used to modify an entity...?

cc: @shabeeb-aot

Start at the Legal API authentication and authorization path used when loading the entity URL in the reproduction, and trace how the account ID is obtained and checked. Done means a request made with the wrong account cannot load or modify that entity’s data; verify the behavior with the reproduction steps and relevant authorization coverage.

Written by the indexing model from the issue text.