xwiki-platform-user-api shouldn't depend on xwiki-platform-security-authentication-api

We created a dependency from xwiki-platform-user-api to xwiki-platform-security-authentication-api which is wrong: it should be other way around.

This will require replacing the currently unstable `UserManager#hasAccess()` API to a specific "read" check version, since it should not be UserManager's job to check for other permissions than just visibility.