[Security] make TokenInterface::getUser() nullable to tell about unauth…

[wouterj]

Q	A
Feature PR	symfony/symfony#42650
PR author(s)	@nicolas-grekas
Merged in	5.4

[javiereguiluz]

Closing in favor of #15908, a meta-issue that groups all pending security-related issues so we can easily check them.