[mail] drop hijack_user usage
The transaction is now commited before notification. We can create a new session
directly and drop `hijack_user` usage.
This prepare #2781782
[notification] move notification view in ``sobject.notification``
It has no user outside this module. This enforce serversideness of
notification and allow future cleanup.
No backward compat is set up to prevent circular import. The class has no other user
anyway.
(closes 2845144)