As speculated in Twitter the command was connect and the activity was logon. After some research the root cause could be found : The report server attempted logon using invalid credentials.
After we had corrected the credentials, the row locks disappeared.
The first good indication of the solution, I got the blog of Dominic Brooks: Failed Logins can cause row cache lock on dc_users. Martin Preiss, too, had found this website when searching for the solution. Stefan Koehler has documented a very similar case in great detail: Wait event “library cache lock” by (security) design and exploring system state dumps (oradebug). Franck Pachot mentioned on Twitter that the “connection management call elapsed time” event in AWR should have been a hint, had I only noticed… Of course, Martin Berger was as always on the right track.