SECURITY FLAW when anonymous users have access to change workflow states

When anonymous users are given permission to make workflow state changes, workflow_execute_transition treats them as the superuser (user ID 1), allowing them to make any transition regardless of permissions.

I have not confirmed this widely, but on my test site the function also authenticates the anonymous user as user ID 1, so that after making any workflow state-change, they are automatically logged in as the administrator.

The attached patch is rolled against 5.x-1.1, but it's just a one-line change so it will probably work on other versions as well. Testing and version-specific patches are appreciated.