Fix EZP-23176: Lazy sessions are not honored in 5.3

> https://jira.ez.no/browse/EZP-23176

Alternative of #932 and https://github.com/ezsystems/ezpublish-legacy/pull/1033 by @joaoinacio .

In security mapper, user was injected in legacy even if the current user wasn't authenticated. Problem is that `eZUser::setLoggedInUser()` always sets a session variable, and thus starts a session.

This patch ensures user is authenticated in security context before injecting the user.
Tests have been updated and improved.