[notification] avoid using InternalManager when we've got a CWUser
This will avoid potential information leak due to missed security restriction
and is more compatible with legacy code (pb encountered in some client code).
Closes #10294761
../../doc/book usr/share/doc/cubicweb-documentation
../../doc/_build/html usr/share/doc/cubicweb-documentation