refactor!: move go-chi/session into Gitea (#39504)

The `gitea.com/go-chi/session` package only exists for Gitea, so it
moves into `modules/session` to fix its bugs directly. Fixes the flake
in
https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400.

- Sessions are only written back when changed, so a read-only request
can't revert a concurrent change or restore a logged-out session, like
https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12
- The session cookie is only set once a session holds data
- Every backend refreshes the expiry on load and file sessions are
written atomically
- Also fix  https://github.com/go-gitea/gitea/issues/36176

## ⚠️ BREAKING ⚠️

* the `mysql`, `postgres`, `couchbase` and `memcache` session providers
are removed, use `file`, `db` or `redis` instead
* login-related cookies are renamed to `gitea_session` and
`gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME`
and `COOKIE_REMEMBER_NAME` in app.ini

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/auth/reverseproxy_test.go

@@ -34,6 +34,16 @@ func TestReverseProxyIgnoresBot(t *testing.T) {
 	assert.Nil(t, user)
 }
 
+type releaseCountingStore struct {
+	session.Store
+	released int
+}
+
+func (s *releaseCountingStore) Release() error {
+	s.released++
+	return s.Store.Release()
+}
+
 func TestReverseProxyLastLogin(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	defer test.MockVariableValue(&setting.ReverseProxyAuthUser, "X-WEBAUTH-USER")()
@@ -41,13 +51,15 @@ func TestReverseProxyLastLogin(t *testing.T) {
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	require.Zero(t, user.LastLoginUnix)
 
-	ctx, resp := contexttest.MockContext(t, "/", contexttest.MockContextOption{SessionStore: session.NewMockMemStore("reverse-proxy-last-login")})
+	sess := &releaseCountingStore{Store: session.NewMockMemStore("reverse-proxy-last-login")}
+	ctx, resp := contexttest.MockContext(t, "/", contexttest.MockContextOption{SessionStore: sess})
 	ctx.Req.Header.Set(setting.ReverseProxyAuthUser, user.Name)
 	rp := &ReverseProxy{CreateSession: true}
 
 	_, err := rp.Verify(ctx.Req, resp, ctx, ctx.Session)
 	require.NoError(t, err)
 	assert.NotZero(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: user.ID}).LastLoginUnix)
+	assert.Equal(t, 1, sess.released)
 
 	user.LastLoginUnix = 1
 	require.NoError(t, user_model.UpdateUserCols(t.Context(), user, "last_login_unix"))
@@ -55,4 +67,5 @@ func TestReverseProxyLastLogin(t *testing.T) {
 	_, err = rp.Verify(ctx.Req, resp, ctx, ctx.Session)
 	require.NoError(t, err)
 	assert.EqualValues(t, 1, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: user.ID}).LastLoginUnix) // no write without a new session
+	assert.Equal(t, 1, sess.released)
 }