security: refactor: don't use custom factory for RestxSessionFilter

now that RestxFactory supports everything needed to use plain
annotation driven injection for RestxSessionFilter, get rid of
custom machine.
security: add RestxSessionBareFilter which allow to implement RestxSession based security with no cookies
security: refactor: rename RestxSessionFilter into RestxSessionCookieFilter

to clarify that this filter is used to build session from Cookies / update session in cookies.
core: give access to underlying native request and response objects
security: allow using servlet principal as restx principal