Callback security and usr (#33599)

* Gonna regret writing this one day

* tmp -> temp

* Make PushUsr() a /world proc

* Callbacks now preserve usr

* Fixes PushUsr return value

* Fixes PushUsr invocations

* Update modifyvariables.dm

* Use weakrefs in callback user

* Further fixes

* Whoopsie

code/__HELPERS/unsorted.dm

@@ -1508,6 +1508,14 @@ GLOBAL_DATUM_INIT(dview_mob, /mob/dview, new)
 				return "\[[url_encode(thing.tag)]\]"
 	return "\ref[input]"
 
+// Makes a call in the context of a different usr
+// Use sparingly
+/world/proc/PushUsr(mob/M, datum/callback/CB)
+	var/temp = usr
+	usr = M
+	. = CB.Invoke()
+	usr = temp
+  
 //Returns a list of all servants of Ratvar and observers.
 /proc/servants_and_ghosts()
 	. = list()