DAV and OCS requests should not initiate a web session

[ChristophWurst]

For historical reasons we use sessions for clients (desktop, mobile). While we block logins with app passwords right now, it is still possible to circumvent this check with an authenticated request to a DAV route as it starts a session as well.

App passwords always have access to the full account, so no data is leaked.

Steps to reproduce

1. Open Nextcloud in the browser
2. Open a valid DAV URL
3. Fill in the basic auth dialog with an app password
4. Go back to the document root

Expected behaviour

Not logged in

Actual behaviour

Logged in

Server configuration

Nextcloud version:

Any

[ChristophWurst]

cc @juliushaertl @rullzer

[ChristophWurst]

Shockingly accurate duplicate of #7628