feat: session binding

[lfleischmann]

Description

These changes add anonymous sessions and bind sessions to flows.

Implementation

Backend

• Make user id in session model optional (no DML/migration needed since it was not enforced on DB level anyway)
• Issue anonymous session cookie
• "Rotate" anonymous sessions to authenticated sessions in hook issuing an authenticated session
• Add reference to session ID in flows
• Extend flowpilot to pass session ID through to creation/updates of flows

Elements

• Make proper use of cleanup functions returned by listener registrations, otherwise listeners stack. For example on logout, this leads to multiple callback calls that repeatedly initialize new flows, which then leads to errors due to "race conditions" regarding setting the anonymous session cookie if multiple intialization requests are made in parallel.