Fix EZP-23176: Lazy sessions are not honored in 5.3

> https://jira.ez.no/browse/EZP-23176

Alternative of #932 and https://github.com/ezsystems/ezpublish-legacy/pull/1033 by @joaoinacio .

In security mapper, user was injected in legacy even if the current user wasn't authenticated. Problem is that `eZUser::setLoggedInUser()` always sets a session variable, and thus starts a session.

This patch ensures user is authenticated in security context before injecting the user.
Tests have been updated and improved.
Basically, when you want to mock static methods, you need to use *class alias/overload* with Mockery. Problem is that it doesn't keep class constants, so here test would crash with a fatal.