Bug 38826: Make check_api_auth $sessionID consistent

This change makes $sessionID consistently return using the session
ID and not sometimes the session object.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies
3. Note the Csrf-Token header value
4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step
using the appropriate values (eg the CSRF-TOKEN is from the previous step)
5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \
    -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \
    'http://localhost:8081/cgi-bin/koha/svc/authentication' \
    -d "login_userid=<USERID>&login_password=<PASSWORD>" \
    --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
    --cookie /tmp/test.cookies > rec.marcxml
7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \
    --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
8. Note the Csrf-Token header value
9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \
    -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
    --cookie /tmp/test.cookies --data @rec.marcxml

Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 04dbbcc2f2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

C4/Auth.pm

@@ -1634,7 +1634,7 @@ sub check_api_auth {
             -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
             -sameSite => 'Lax'
         );
-        return ( $return, $cookie, $session ); # return == 'ok' here
+        return ( $return, $cookie, $session->id ); # return == 'ok' here
 
     } else {