Move away from flask.g.user

[legoktm]

Description

Previously we had identified that sticking stuff onto flask.g should be discouraged because it hurts type checking, pylint doesn't like it, etc.

With g.user specifically, it's somewhat problematic because it's now a secondary source of whether a user is logged in or not, and who that user is - which is really the responsibility of the session. In the process of developing #6403, we hit this and needed to add more checks to keep them in sync.

But now that we have a custom session class, we could easily add a session.current_user() that returns a Journalist object, and not have to worry about it falling out of sync with the session.