[6.x] Fix CP header avatar for assets in private containers

[lazerg]

This pull request fixes an issue where the avatar in the CP header is a broken image when the user's avatar asset lives in a private container.

The header reads the user from JavascriptComposer::user(), which passes the augmented user to the front end. There avatar is the augmented asset, and its permalink is null because private containers have no URL, so the <img> gets no src.

This PR fixes it by setting avatar to $user->avatar(), which returns the CP thumbnail URL (or the Gravatar fallback). The Users listing already uses it, and the Avatar component already accepts a string.

avatar() used to throw when the avatar field augments to a query (no max_files: 1, or always_augment_to_query enabled). Now that it runs on every CP page, it takes the first asset from the query instead.

Fixes #15605