Move generateChallenge/revokeChallenge to ISession

This also makes challenges user-specific, which is fine. Older
HAL interfaces can just ignore the userId parameter.

Test: Enroll, auth on existing devices
Fixes: 170517180
Fixes: 171002801
Change-Id: Ie0fc030476350bc3c35fc28643108ad4d4d3f2ce