[grid] Should not accept data from data provider callbacks that were already used

[vursen]

Description

A finding from #5961:

Currently, Grid tries to set new items and update the size whenever a data provider callback is called, regardless if there is a corresponding pending page request. This has at least several negative consequences:

1. Data is accepted even if the same data provider callback was already called once.
2. Data is accepted even if the cache was cleared while the page request was pending.

Besides, this doesn't align with combo-box which ignores such callback invocations.

Expected outcome

Invocations of a data provider callback should be ignored if that callback isn't present in the page queue.

Here is how it's done in combo-box:

web-components/packages/combo-box/src/vaadin-combo-box-data-provider-mixin.js

Lines 180 to 183 in d71cf05

	const callback = (items, size) => {
	if (this._pendingRequests[page] !== callback) {
	return;
	}

Minimal reproducible example

<script type="module">
  import '@vaadin/grid/all-imports';

  const grid = document.querySelector('vaadin-grid');
  grid.dataProvider = (params, callback) => {
    callback([{ title: 'Item 1' }, { title: 'Item 2' }], 2);
    callback([{ title: 'Malicious!' }], 1);
  }
</script>

<vaadin-grid>
  <vaadin-grid-column path="title"></vaadin-grid-column>
</vaadin-grid>

Steps to reproduce

1. Add the above snippet to a page
2. Observe "Malicious!" in the first row

Environment

Vaadin version(s): 24.3 and earlier
OS: Mac OS

Browsers

Issue is not browser related