refactor!: configure the session lifetime as a policy object

[gharlan]

Removes session_duration, session_keep_alive, session_max_overall_duration and session_warning_time from the config.yml. They describe one thing — how long a backend session lives and when the user gets warned — so they become one object, next to the two policies that moved in #6655:

BackendLogin::$sessionPolicy = new SessionPolicy(duration: 1800, warningTime: 60);

keepAlive and warningTime are only handed to the backend js; duration and maxOverallDuration are additionally used by BackendLogin, UserSession, HistoryLogin and the session status api function.

The base class stops reading global config

Login::__construct() read session_max_overall_duration — and Login is the base class for frontend logins too, which therefore silently inherited the backend's limit. The property now carries the four weeks as its default, and BackendLogin sets both durations from its policy.

This is a behaviour change: a project that configured session_max_overall_duration also affected addon frontend logins until now. Those fall back to the default; a login outside the backend that wants its own limit sets $sessionMaxOverallDuration on its own class.

No validation

Unlike LoginPolicy, which rejects zeros because a zero silently locks everyone out of the backend, SessionPolicy takes the values as they are: keepAlive: 0 is a meaningful "no keep alive", and the js treats it that way.

Not in here

session.* — the cookie parameters and the save path — stays for now. It is the block that should be answered together with issue #2065 (Login::startSession() implies a login) and with the question whether the session mechanics move onto symfony/http-foundation's session, which is already a direct dependency and whose NativeSessionStorage takes exactly these options. Migrating that block into a REDAXO object first would mean migrating projects twice.

Verified

The four values reach rex.session_* in the backend js, both with the defaults and with a project policy (duration: 900, keepAlive: 0, warningTime: 60), and the session status api reports rest_overall_time from the configured maxOverallDuration.