Fix EZP-22163: As a REST User I need to re authenticate existing session on login

## Link
Suggestion from : https://github.com/ezsystems/ezpublish-kernel/pull/682 
JIRA link : https://jira.ez.no/browse/EZP-22163

## Description
 The goal here is to change the existing POST /user/sessions to allow for common use case needed by session based REST clients, re authenticate a user when he comes back to application but while session cookie is still existing (session cookie might not be available to javascript for security reasons btw).

Two points :
In a first hand POST /user/sessions with a correct login / pass and with <b>session cookie</b> gives:
 <ul>   <li>    If the session differs, 201 like now (or other response code as we can't provide Location header) </li>
<li>    If the corresponding session exists, 200 with the same response as for the previous case</li> </ul>

In a second hand POST /user/sessions/\<sessionId>/refresh A new resource where you can POST with <b> session cookie and csrf token</b> :
<ul>   <li> If the session is valid => 200 (204 would work if we don't provide a body)</li>
   <li> 404 if the session is not valid</li> </ul>

Specifications have also been updated.