Cleanup User::hasPermission() and UserSession::hasPermission() to follow Law of Demeter

Spin-off from #2202185: Statically cache Role entities to speed up (User|UserSession)::hasPermission(), but moving just the DX cleanup into this issue, so that issue is focused on just the performance concerns.