Separate session management from PhabricatorUser

Summary: Ref T4310. Ref T3720. Session operations are currently part of PhabricatorUser. This is more tightly coupled than needbe, and makes it difficult to establish login sessions for non-users. Move all the session management code to a `SessionEngine`.

Test Plan:
  - Viewed sessions.
  - Regenerated Conduit certificate.
  - Verified Conduit sessions were destroyed.
  - Logged out.
  - Logged in.
  - Ran conduit commands.
  - Viewed sessions again.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4310, T3720

Differential Revision: https://secure.phabricator.com/D7962

src/applications/auth/controller/PhabricatorAuthController.php

@@ -81,7 +81,8 @@ abstract class PhabricatorAuthController extends PhabricatorController {
 
     $should_login = $event->getValue('shouldLogin');
     if ($should_login) {
-      $session_key = $user->establishSession($session_type);
+      $session_key = id(new PhabricatorAuthSessionEngine())
+        ->establishSession($session_type, $user->getPHID());
 
       // NOTE: We allow disabled users to login and roadblock them later, so
       // there's no check for users being disabled here.