introduce SessionMiddleWare to control session handling via an annotatio...

...n

refs https://github.com/owncloud/core/issues/11566

@LukasReschke @Raydiation THX
From my understanding adding this here will prevent application specific middleware to modify the session unless the controller has explicitly opted-in to use the session.

IMHO this is a somewhat unexpected behaviour and one should be able to use the session in `beforeController` and `afterController` within middlewares - we should just close the session right before the real controller is executed.

Anybody has an idea how we can best implement this?