Fix EZP-22220: Session creation in REST API doesn't use Symfony SecurityContext properly

Issue: https://jira.ez.no/browse/EZP-22220

This made it impossible to use multiple user providers (see #683).
It also had the side-effect that authorization didn't work correctly when checking with SecurityContext.

This patch refactors the REST User/creationSession controller by extracting all the authentication logic to a proper *Authenticator* service.
A security factory is introduced along with a new setting in `ezpublish/config/security.yml` to allow the authentictor to work.
The authenticator service needs indeed to be registered as a *Firewall listener* to be aware of the SecurityContext `providerKey`, represented by
the identifier of the configured firewall currently in use.

## Configuration change in `security.yml`
A configuration change in `security.yml` is needed:

**After**
```diff
--- a/ezpublish/config/security.yml
+++ b/ezpublish/config/security.yml
@@ -26,9 +26,8 @@ security:

         ezpublish_rest:
             pattern: ^/api/ezp/v2
-            stateless: true
-            ezpublish_http_basic:
-                realm: eZ Publish REST API
+            anonymous: ~
+            ezpublish_rest_session: ~

         ezpublish_front:
             pattern: ^/
```
EZP-22220: Added unit tests
EZP-22220: Refactored to extract AuthenticatorInterface
EZP-22220: Moved CSRF token generation after authentication occured

This avoids the session to start if authentication failed.
Also removed manual session start since it's not needed. CsrfProvider will do it seamlessly.
Merge pull request #814 from ezsystems/impl_EZP-22220_RESTAuthenticationSymfony

Fix EZP-22220: Session creation in REST API doesn't use Symfony SecurityContext