Moved session initialization from bootstrapper to factory.

- Refactored use of Zend\Session\Container to inject proper session manager
- Introduced "on demand session container" mechanism for non-critical session data (only used by Demo ILS driver for now)
- Changed controllers to retrieve authorization service on demand rather than through injection (to defer session load)
- Replaced \VuFind\Controller\AbstractBase::writeSession() with \VuFind\Controller\AbstractBase::disableSessionWrites (and new related mechanism for safer AJAX session utilization)
- This makes sessions "on demand" which improves performance of requests that do not depend on session data (e.g. cover images, some AJAX calls).