Fix EZP-22220: Session creation in REST API doesn't use Symfony SecurityContext properly

Issue: https://jira.ez.no/browse/EZP-22220

This made it impossible to use multiple user providers (see #683).
It also had the side-effect that authorization didn't work correctly when checking with SecurityContext.

This patch refactors the REST User/creationSession controller by extracting all the authentication logic to a proper *Authenticator* service.
A security factory is introduced along with a new setting in `ezpublish/config/security.yml` to allow the authentictor to work.
The authenticator service needs indeed to be registered as a *Firewall listener* to be aware of the SecurityContext `providerKey`, represented by
the identifier of the configured firewall currently in use.

## Configuration change in `security.yml`
A configuration change in `security.yml` is needed:

**After**
```diff
--- a/ezpublish/config/security.yml
+++ b/ezpublish/config/security.yml
@@ -26,9 +26,8 @@ security:

         ezpublish_rest:
             pattern: ^/api/ezp/v2
-            stateless: true
-            ezpublish_http_basic:
-                realm: eZ Publish REST API
+            anonymous: ~
+            ezpublish_rest_session: ~

         ezpublish_front:
             pattern: ^/
```
EZP-22220: Added unit tests