feat(http): validate session identifiers

[osbre]

Adds strict validation to SessionId to prevent potential path traversal vulnerabilities when session identifiers are used as filenames.

Validating at the SessionId level ensures that all storage drivers and resolvers automatically inherit this security guarantee. This approach matches standard practices used by other frameworks (such as Laravel and Symfony) for file-based session handlers. Existing UUIDs and standard identifiers remain fully compatible.

Testing

Added unit tests in packages/http/tests/Session/SessionIdTest.php.

[github-actions]

Benchmark Results

Comparison of harden/session-id-validation against 3.x (16a1a2a6db94d90ca803ae4442520b880813d4e5).

Open to see the benchmark results

Benchmark	Set	Mem. Peak	Time	Variability
ViewRenderBench(benchExpressions)	-	24.592mb 0.00%	261.719μs -5.27%	±0.88% +53.88%
ContainerBench(benchRegisterInitializer)	-	6.419mb 0.00%	3.254μs +6.79%	±0.83% -30.24%
ContainerBench(benchRegisterClosureSingleton)	-	6.453mb 0.00%	1.469μs +11.10%	±1.57% -45.79%

_{Generated by phpbench against commit c74c33f}

[brendt]

Thanks!