MDL-32379: Fix memory leak in session_set_user

session_set_user mistakingly sets the session user to be a reference to the passed object.

This is a problem when alot of data is attached to the session user object,
as any process holding a list of these users will use more memory each time it changes user.

lib/sessionlib.php

@@ -1067,7 +1067,7 @@ function get_moodle_cookie() {
  * @return void
  */
 function session_set_user($user) {
-    $_SESSION['USER'] = $user;
+    $_SESSION['USER'] = clone $user;
     unset($_SESSION['USER']->description); // conserve memory
     sesskey(); // init session key