Fix embed download endpoint (#41264) (#41266)

* Fix embed download endpoint

We have added format_rows as a query parameter. In most endpoints this just works fine.

Here, however, the problem is that we use query parameters to pass parameter values. We run some validation over these
provided parameter values (eg. don't allow a user to over ride a 'locked' parameter). Since we have these 2 different
use cases for query parameters, the validation was failing on :format_rows, which isn't expected to exist at all.

Here, I dissoc the :format_rows key prior to this validation step, so normal validation can continue.

* Add test that uses this card embedding endpoint

Co-authored-by: adam-james <21064735+adam-james-v@users.noreply.github.com>

src/metabase/api/embed.clj

@@ -408,13 +408,13 @@
 
 (api/defendpoint GET ["/card/:token/query/:export-format", :export-format api.dataset/export-format-regex]
   "Like `GET /api/embed/card/query`, but returns the results as a file in the specified format."
-  [token export-format :as {:keys [query-params format_rows]}]
+  [token export-format format_rows :as {:keys [query-params]}]
   {export-format (into [:enum] api.dataset/export-formats)
    format_rows   [:maybe :boolean]}
   (run-query-for-unsigned-token-async
    (embed/unsign token)
    export-format
-   (m/map-keys keyword query-params)
+   (dissoc (m/map-keys keyword query-params) :format_rows)
    :constraints nil
    :middleware {:process-viz-settings? true
                 :js-int-to-string?     false

test/metabase/api/embed_test.clj

@@ -1588,7 +1588,8 @@
           output-helper {:csv  (fn [output] (->> output csv/read-csv last))
                          :json (fn [output] (->> output (map (juxt :NUMBER :DATE)) last))}]
       (with-embedding-enabled-and-new-secret-key
-        (t2.with-temp/with-temp [Card {card-id :id} {:display :table :dataset_query q}
+        (t2.with-temp/with-temp [Card {card-id :id} {:enable_embedding true
+                                                     :display :table :dataset_query q}
                                  Dashboard {dashboard-id :id} {:enable_embedding true
                                                                :embedding_params {:name "enabled"}}
                                  DashboardCard {dashcard-id :id} {:dashboard_id dashboard-id
@@ -1598,6 +1599,12 @@
                                                               [:json true ["2,000" "March 26, 2024"]]
                                                               [:json false [2000 "2024-03-26"]]]]
             (testing (format "export_format %s yields expected output for %s exports." apply-formatting? export-format)
+              (is (= expected
+                     (->> (mt/user-http-request
+                           :crowberto :get 200
+                           (format "embed/card/%s/query/%s?format_rows=%s"
+                                   (card-token card-id) (name export-format) apply-formatting?))
+                          ((get output-helper export-format)))))
               (is (= expected
                      (->> (mt/user-http-request
                            :crowberto :get 200