[2.x] fix: prevent UserSecurityPage crash when user loads asynchronously

[datlechin]

UserSecurityPage.oninit calls loadTokens() immediately after loadUser(), assuming this.user is set synchronously. That assumption only holds when the route slug equals the user's username, so any non-default slug driver (built-in IdWithDisplayName included) crashes with:

TypeError: Cannot read properties of null (reading 'id') at UserSecurityPage.loadTokens (UserSecurityPage.tsx:201)

To reproduce: set the user slug driver to IdWithDisplayName in admin, then visit /u/<id>-<name>/security.

The fix has two parts:

1. UserPage.loadUser returns Promise<void> so subclasses can chain dependent work after the user resolves. UserSecurityPage chains loadTokens() onto it.
2. The in-store sync match in loadUser also compares user.slug(), and the preloaded API document's primary resource is used directly when present. This eliminates the loading flicker that otherwise appears on every initial render under non-default slug drivers (the page used to render loading=true while the async user fetch ran).

Test plan

• yarn build in framework/core/js passes.
• IdWithDisplayName slug driver: /u/<id>-<name>/security loads without crash.