Replace Userrequest.identity usages with UserContext

[woodruffw]

Following #15581 and #15590: we now have three types that a request.identity can be:

• User when the identity is a user backed by a login session
• UserTokenContext when the identity is a user backed by an API token (i.e. macaroon)
• PublisherTokenContext when the identity is an OIDCPublisher backed by an API token

Of these, User and UserTokenContext are confusable and prone to error. We should probably collapse them into a single UserContext type of the following shape:

@dataclass
class UserContext:
    user: User
    """
    The associated user.
    """

    macaroon: Macaroon | None
    """
    The Macaroon associated to the API token used to authenticate, if token authentication was used.
    """

    def __principals__(self) -> list[str]:
        return self.user.__principals__()

...with that, we'll be able to remove UserTokenContext and simplify request.identity back down to just two types.

[woodruffw]

CC @facutuesca

[facutuesca]

PR open here: #15757