Decouple SessionMetadata and TransportCredentials

TransportCredentials are per-request, not per-session, and
there's no reason to carry them within SessionMetadata.

While I'm in here, get rid of "null" credentials.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=125202213

java/google/registry/flows/EppController.java

@@ -51,7 +51,10 @@ public final class EppController {
    * Read an EPP envelope from the client, find the matching flow, execute it, and return
    * the response marshalled to a byte array.
    */
-  public byte[] handleEppCommand(SessionMetadata sessionMetadata, byte[] inputXmlBytes) {
+  public byte[] handleEppCommand(
+      SessionMetadata sessionMetadata,
+      TransportCredentials credentials,
+      byte[] inputXmlBytes) {
     Trid trid = null;
     try {
       EppInput eppInput = unmarshal(EppInput.class, inputXmlBytes);
@@ -68,6 +71,7 @@ public final class EppController {
           eppInput,
           trid,
           sessionMetadata,
+          credentials,
           inputXmlBytes,
           metrics,
           clock);