Session token "safety window" when refreshing

[br41nslug]

Implement a "safety window" keeping the old token active for a short amount of time to resolve in-flight requests using the previous token.

As described here https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renewal-timeout

Fixes #22360

Scope

What's changed:

• Session IDs no longer get replaced on refresh but a new session ID is saved while the old one is kept for a short duration of time, the so called "safety timeout" or "grace period".
• On refresh the expired sessions for the current user will be deleted
• Adds a new column to the directus_sessions table used to link refreshed sessions to their successor.

Potential Risks / Drawbacks

• Potential performance impact on the refresh endpoint where deleting the sessions
• Can impact the security if a long grace period is set

Review Notes / Questions

• I would like to lorem ipsum
• Do we want to call the environment variable SESSION_REFRESH_GRACE_PERIOD?
• Is a grace period of 10seconds a good default?

[joselcvarela]

Looks good to me ✅