refactor!: move go-chi/session into Gitea (#39504)

The `gitea.com/go-chi/session` package only exists for Gitea, so it
moves into `modules/session` to fix its bugs directly. Fixes the flake
in
https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400.

- Sessions are only written back when changed, so a read-only request
can't revert a concurrent change or restore a logged-out session, like
https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12
- The session cookie is only set once a session holds data
- Every backend refreshes the expiry on load and file sessions are
written atomically
- Also fix  https://github.com/go-gitea/gitea/issues/36176

## ⚠️ BREAKING ⚠️

* the `mysql`, `postgres`, `couchbase` and `memcache` session providers
are removed, use `file`, `db` or `redis` instead
* login-related cookies are renamed to `gitea_session` and
`gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME`
and `COOKIE_REMEMBER_NAME` in app.ini

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/setting/session_test.go

@@ -69,7 +69,6 @@ PROVIDER = file
 
 			loadRedisFrom(cfg)
 			loadSessionFrom(cfg)
-			// ProviderConfig is shadowed into a JSON blob at the end of loadSessionFrom
 			assert.Contains(t, SessionConfig.ProviderConfig, tt.wantContain)
 			if tt.wantMissing != "" {
 				assert.NotContains(t, SessionConfig.ProviderConfig, tt.wantMissing)
@@ -77,3 +76,14 @@ PROVIDER = file
 		})
 	}
 }
+
+func TestSessionNonPositiveLifetimesUseDefaults(t *testing.T) {
+	defer test.MockVariableValue(&SessionConfig)()
+	for _, lifetime := range []string{"0", "-1"} {
+		cfg, err := NewConfigProviderFromData("[session]\nGC_INTERVAL_TIME = " + lifetime + "\nSESSION_LIFE_TIME = " + lifetime)
+		assert.NoError(t, err)
+		loadSessionFrom(cfg)
+		assert.EqualValues(t, 3600, SessionConfig.Gclifetime)
+		assert.EqualValues(t, 3600, SessionConfig.Maxlifetime)
+	}
+}