kill OC::$session

TL;DR: having two places where the session is stored is a bad idea

Currently OC::$session is initialized before setting up the OC::$server container. Unfortunately, the container stores the session itself and as a result will get out of sync when OC::$session is replaced directly. An example is cron.php.

This PR makes the UserSession object contain the one and only session reference. the server container delegates getSession and setSession to the UserSession. Setting a session will close the previous session.  This seems to change a lot in core but actually only replaces occurences of `\OC::$session` with `\OC::$server->getSession()` and of course handles setting a new session and initializing it in lib/base.php

Notifying @owncloud/core-developers to spread the word.

Personally, I need to be able to set the userid in the session available in cron.php to set up the filesystem for a user when indexing files in search_lucene. Currently, core is broken in this regard and prevents me using the appframework (parts that are available in core).

@karlitschek @craigpg I *really* want this in OC7 but we should postpone it to 7.0.1 for stability reasons. I'll defer the new search lucene to 7.0.1 then as well.
\OC::$session was passed by ref here to allow manipulation (aka set to a different object) - grr I knew this approch will kill us :imp: