[connection] move security control logic on Connection
The _security_enabled context manager now operate on connection. We have to keep
a specific entry point in Session to ensure Connection object are properly
cleaned up when using session to "manage" Connection live cycle.
Related to #2503918