refactoring user interactive auth

[hkohlsaat]

• making members of auth.UserInteractive private as they aren't used outside of the package and in order to protect from concurrent writes
• making the mutex protect the sessions only as only they are written to concurrently

This prepares future contributions I plan, in particular adding functionality for multi-stage flows.

Pull Request Checklist

• I have justified why this PR doesn't need tests: No functionality added or removed, only refactoring tested behaviour.
• I have already signed off privately.

[S7evinK]

Other than the minor nits, looks fine to me.

Can we test the changes? Or do you plan to add tests when adding multi-stage flows?

[hkohlsaat]

Can we test the changes?

As I wrote in the description, I only refactored internals of a tested module.
Almost all behavior of this file is tested. Especially the lines I changed are tested already as far as I checked. All I did is slightly refactoring the internals with tests passing before and after - without any intent to change behaviour. I don't see how one would add more tests without overdoing it, given the overseeable amount of changes. Is this okay with you? If not, could you give me an example of what you would like to have tested, additionally?
(Of course, conversely, I would add tests for multi-stage flows when I work on them, because that would be a change in behaviour. But I guess that's beside the point of these changes and your comment?)