feat(*): Redis-backed revocation for stateless cookie sessions

[Hockenba]

Summary

Adds optional Redis-backed session revocation for stateless (cookie) sessions.

• On session:open, check whether the session ID is in the denylist.
• On session:destroy, write a lightweight sentinel to Redis with TTL matching remaining session lifetime (no session payload in Redis).

Revocation loads when storage is nil or "cookie" and Redis is configured for revocation (redis.mode = "revocation", or omitted mode with a redis.host). It can also be enabled explicitly via revocation = true or disabled with revocation = false.

revocation_fail_mode defaults to "open" (Redis unreachable → treat as not revoked; destroy still clears the cookie). "closed" rejects open/destroy when the store is unavailable.

Revocation applies to full destroy / single-audience logout. It does not apply to session:save rotation or partial multi-audience logout.

Consumer: apache/apisix#13651.

Test plan

• make unit / busted spec/06-revocation-1_spec.lua spec/07-revocation-2_spec.lua
• spec/06-revocation-1_spec.lua
  • Normal use: open, destroy+revoke, save rotation (no revoke), cookie-only destroy
  • Redis store: SET/GET, missing key, TTL expiry
  • Configuration: explicit/implicit redis.mode, redis storage skip, revocation=false, no host
• spec/07-revocation-2_spec.lua
  • Fail modes: default open, open destroy degrade, closed open reject, closed destroy fail
  • Validation: default revocation_fail_mode, redis+revocation mode reject, invalid revocation type
  • Redis connection failures on SET/GET