SERVER-9516 Acquire auth update lock in upgrade command, not in upgradeSchemaStep() method.
SERVER-9516 User objects must be immutable after first returned from AuthManager.

The mechanism for probing schemaVersion24 users was not respecting this requirement
before this patch, which would have led to concurrency errors.

Also, with this change the internalSecurity.user is never stored in the cache, and
its reference count is never altered.