Promote usage of Subjects in Authentication class (#88494)

This PR is a follow-up of #86246 to further clean up the Authentication
class by: * Promote usage of the Subject class. The User field and a few
other   related fields are now removed from Authentication. Relevant
methods   have their implementation replaced by using Subjects and same 
behaviours are retained. * Remove the temporary internal RunAsUser
class. Its essence is about   wire serialisation which is now merged
into Authentication itself. * Simplify serialisation of regular User
object. All the complexities of   handling inner user is now completely
within the Authentication class   itself. * Consolidate assertions in
different places into a single method that   is called in constructors.
Also removed a few assertions because there   is no RunAsUser class
anymore and a User object is just a simple user.

Relates: #86246 Relates: #86544

Resolves: #80117

Author: ywangd