Inject the session service into FileAccessControlHandler so it can use it for anonymous access checks

There is a @todo in the code that was added to Drupal 8 to fix https://www.drupal.org/SA-CORE-2017-003:

          // @todo - implement \Symfony\Component\DependencyInjection\ContainerInterface
          // so that services can be more properly injected.
          $allowed_temp_files = \Drupal::service('session')->get('allowed_temp_files', []);

This issue is for resolving that @todo.