Combine `User` and `UserTokenContext` for user-backed identities in requests

[facutuesca]

Fixes https://github.com/pypi/warehouse/issues/15748.

We have three types that a request.identity can be:

• User: when the identity is a user backed by a login session
• UserTokenContext: when the identity is a user backed by an API token (i.e. macaroon)
• PublisherTokenContext: when the identity is an OIDCPublisher backed by an API token

Of these, User and UserTokenContext are confusable and prone to error.

This PR collapses them into a single UserContext type.

cc @woodruffw @di