Caching of system users authorization details are broken

[elsand]

Description

When generating cache keys for system users, the system user id is not part of the list of identifiable claims on which the key is based

Reproduction

1. Perform a request to a dialog, using a system user that has been granted access to the dialog, owned by the same organization (consumer/supplier)
2. Perform a request to a dialog, using a different system user that has NOT been granted access to the dialog, owned by the same organization (consumer/supplier)

Expected behavior

1. OK
2. Unauthorized

Actual behavior

1. OK
2. OK

Additional information

The two requests will have identical cache keys, causing the second request from to hit the cache for the PDP call. This is a security issue, but mitigated by the fact that it must be owned by the same organization.