Revert "Return Macaroon alongside User in `MacaroonSecurityPolicy…

[di]

….identity` (#15581)"

This reverts commit 862a451.

I believe this is the cause of #15586 and possibly pypi/support#3740.

cc @facutuesca @woodruffw

[di]

Looks like this is failing here, when creating a new project:

warehouse/warehouse/forklift/legacy.py

Lines 984 to 995 in 5eba9cb

	if not request.user:
	raise _exc_with_message(
	HTTPBadRequest,
	(
	"Non-user identities cannot create new projects. "
	"This was probably caused by successfully using a pending "
	"publisher but specifying the project name incorrectly (either "
	"in the publisher or in your project's metadata). Please ensure "
	"that both match. "
	"See: https://docs.pypi.org/trusted-publishers/troubleshooting/"
	),
	)

[di]

And here when uploading a new release to an existing project:

warehouse/warehouse/macaroons/caveats/__init__.py

Lines 107 to 108 in 862a451

	if not isinstance(request.identity, User):
	return Failure("token with user restriction without a user")

[di]

(Both with account-wide API tokens)

[webknjaz]

xref pypa/gh-action-pypi-publish#222

[woodruffw]

Thanks for the ping, sorry for the headache here. I totally forgot about those instance checks; will look into a more complete patch now.

(And thanks @webknjaz for triaging on your end!)

[woodruffw]

Opened #15590 as a draft for this, looking at tests now 🙂