refactor!: move go-chi/session into Gitea (#39504)

The `gitea.com/go-chi/session` package only exists for Gitea, so it
moves into `modules/session` to fix its bugs directly. Fixes the flake
in
https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400.

- Sessions are only written back when changed, so a read-only request
can't revert a concurrent change or restore a logged-out session, like
https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12
- The session cookie is only set once a session holds data
- Every backend refreshes the expiry on load and file sessions are
written atomically
- Also fix  https://github.com/go-gitea/gitea/issues/36176

## ⚠️ BREAKING ⚠️

* the `mysql`, `postgres`, `couchbase` and `memcache` session providers
are removed, use `file`, `db` or `redis` instead
* login-related cookies are renamed to `gitea_session` and
`gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME`
and `COOKIE_REMEMBER_NAME` in app.ini

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/auth/auth.go

@@ -40,19 +40,14 @@ func Init() {
 // handleSignInNonInteractive clears existing session variables and stores new ones for the specified user object
 // it is mainly for middleware sign-in which doesn't need user's interaction.
 func handleSignInNonInteractive(resp http.ResponseWriter, req *http.Request, sess SessionStore, user *user_model.User) {
-	// We need to regenerate the session...
-	newSess, err := session.RegenerateSession(resp, req)
-	if err != nil {
-		log.Error(fmt.Sprintf("Error regenerating session: %v", err))
-	} else {
-		sess = newSess
-	}
-
+	sess.Regenerate(resp, req)
 	ClearSessionKeysForSignIn(sess)
-	err = sess.Set(session.KeyUID, user.ID)
-	if err != nil {
+	if err := sess.Set(session.KeyUID, user.ID); err != nil {
 		log.Error(fmt.Sprintf("Error setting session: %v", err))
 	}
+	if err := sess.Release(); err != nil { // save before a long-lived handler like a websocket runs
+		log.Error("Error saving session: %v", err)
+	}
 
 	opts := &user_service.UpdateOptions{SetLastLogin: true}
 	// Language setting of the user overwrites the one previously set