KILL authorization trusts the presented login name instead of the authenticated anonymous account

When a supplied username falls back to an anonymous MariaDB account, the security context retains the supplied login name in `user` while the authenticated identity in `priv_user` is empty. KILL authorization compares `user`, allowing the anonymous session to kill a connection whose user matches …

CREATE USER ''@'127.0.0.1';
CREATE USER 'killvictim'@'localhost'
  IDENTIFIED BY 'victim-test-only';
FLUSH PRIVILEGES;