Once the auditing subsystem purely relies on AuditUserAttrs to source the user and roles for a given log event, we can get rid of the impersonated user and impersonated roles stored on AuthorizationSession.

We may also be able to get rid of ImpersonationSession and other classes responsible for setting and getting impersonated user/roles on AuthorizationSession.

We should also consider removing clearImpersonatedUserData as well.