[SA] Only call Confirm() on authenticators that were involved in Authenticate()

[nicolaslara]

This improves performance and makes it easier to reason about which authenticators will execute and what the results will be.

To implement this, we should keep track in memory of which authenticators were called in execute and use that in the post handler.

Ideally, we make this traverse compound authenticators so that we only call the ones that succeeded there too.