Fix onUserLoadFromSession and pending consumers

We want to allow the consumer to be used by the user who proposed it
even if it is still pending approval. But the test is failing because
we're testing whether the anonymous $user owns the consumer, rather than
the user that we are attempting to authorize.

The fix is to fetch the local user from the access token first and then
validate that the consumer is owned by that user.

Bug: 55587
Change-Id: I26a90783eee2be0ecee01c2fd66114b798568928