Fix EZP-22220: Session creation in REST API doesn't use Symfony SecurityContext

Issue: https://jira.ez.no/browse/EZP-22220

This made it impossible to use multiple user providers (see #683).
It also had the side-effect that authorization didn't work correctly when checking with `SecurityContext`.

This patch refactors the REST User/creationSession controller by extracting all the authentication logic to a proper *Authenticator* service.
A security factory is introduced along with a new setting in `ezpublish/config/security.yml` to allow the authenticator to work. The authenticator service needs indeed to be registered as a *Firewall listener* to be aware of the SecurityContext `providerKey`, represented by the identifier of the configured firewall currently in use.

## Activation
In order to activate session authentication, one need to add `ezpublish_rest_session: ~` under the current firewall.

> **Important note**: Session authentication in REST currently conflicts with basic auth. You **must** deactivate basic auth to make session authentication work.

Example:
```diff
--- a/ezpublish/config/security.yml
+++ b/ezpublish/config/security.yml
@@ -33,6 +33,7 @@ security:
         ezpublish_front:
             pattern: ^/
             anonymous: ~
+            ezpublish_rest_session: ~
             form_login:
                 require_previous_session: false
             logout: ~
```