[2.x] feat: configurable session and token lifetimes

[imorland]

How long people stay signed in is currently fixed: one hour for a normal sign-in, five years for "remember me", and a two hour server-side session. The only way to change any of it is to redefine a core class, because the lifetime lives in a protected static property.

This makes all three configurable, in config.php or from the admin panel, with config.php taking precedence. Nothing changes for a forum that configures nothing.

Token lifetimes are resolved rather than fixed. AccessToken::lifetime() checks config.php, then the settings table, then the value the class declares. The two query scopes that decide validity and expiry use it. $lifetime stays as the default, so subclasses that set it keep working.

Every registered token type is configurable, not a fixed list of two. The admin panel builds its controls from AccessToken::getModels(), so a type added by an extension gets a lifetime control with no core change. A type can opt out with $configurableLifetime = false — DeveloperAccessToken does, since those are issued to scripts deliberately and an expiry set in the admin panel would break them quietly weeks later.

New Extend\AccessToken extender replaces calling AccessToken::setModel() from a service provider, which was undiscoverable and had no way to declare anything about the type.

OAuth is covered by this. Forum\Auth\ResponseFactory mints a RememberAccessToken, so every login through another service inherits the remember lifetime. Right now that means OAuth users get a five year session whether they wanted one or not, and a forum with a shorter session policy can't apply it to them at all.

Also adds a session-cookie option to expire on browser close, for shared computers. That's about the cookie only — the session stays valid server-side.

CollectGarbage now reads the same session lifetime as the cookie does. It previously used the hardcoded 120 minutes independently, so a shortened session would have been left on disk until the old default caught up.

RememberAccessToken::rememberCookieLifeTime() still works, delegating to lifetime(), and is marked deprecated.

Config

'session' => [
    'lifetime' => 120,
    'cookie_expires_on_close' => false,
    'tokens' => [
        'session' => 3600,
        'session_remember' => 157680000,
    ],
],

Anything set here is shown read-only in the admin panel, so session lengths can be pinned where an administrator can't loosen them.

Docs: flarum/docs#573