IAM: Refactor user session management to middleware

[reinkrul]

Fixes #3005

Moves user session management to Echo middleware. Functional changes:

• If a user session already exists and preauthorized user details are provided, earlier it checked whether the user details of the subsequent "user access token flow" were the same as the one that were used to create the session (XIS sanity check). This check is now became unpractical, since the user details aren't available as-is in the session any more. Also, this is the responsibility of the calling XIS.
• Before, only 1 session cookie could exist for a user, so if the user performed a user access token flow for a different did:web DID, things would break (session not found/invalid). This is now fixed, by allowing multiple sessions (bound to web DID) to co-exist, allowing multi-tenancy.
• Changed the session from Host prefix to Secure prefix, as Host prefix does not allow a path other than /

[woutslakhorst]

I think middleware should be located next to other middleware. Maybe in http/session or http/user? This would solve most weird naming. user.Wallet vs usersession.UserWallet.... and user.Session vs usersession.Data