(CDAP-355) Insecurely pass user id from router to downstream services

This insecurely sets the user id received in the headers as a `ThreadLocal` in `SecurityRequestContext`.

`AuthenticationChannelHandler` is added as a channel pipeline modifier in `BaseNettyHttpServiceTemplate.get()` which all of our services have been changed to use instead of `NettyHttpService.builder()`.
This means the workflow tracking server also needs authentication? It's an internal API that only called from master.