implement ui client session id

This changeset introduces a client side session id, which is generated
once by the client (ui: apiClient) and is send with each request to server.
The server makes the session id available by the PrincipalCollection of the
subject.

scm-webapp/src/main/java/sonia/scm/security/BearerRealm.java

@@ -56,7 +56,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 @Extension
 public class BearerRealm extends AuthenticatingRealm
 {
-  
+
   /** realm name */
   @VisibleForTesting
   static final String REALM = "BearerRealm";
@@ -104,6 +104,7 @@ public class BearerRealm extends AuthenticatingRealm
     return helper.authenticationInfoBuilder(accessToken.getSubject())
       .withCredentials(bt.getCredentials())
       .withScope(Scopes.fromClaims(accessToken.getClaims()))
+      .withSessionId(bt.getPrincipal())
       .build();
   }