AuthorizationDataProviderInterface.php

This way we can return attributes even for system users, assuming they
are not tied to some user.

This is an API break, so bundles need to be updated.