[banghamid]

Description
In Session::start(), when an incoming session cookie fails validation (! is_string($cookie) || preg_match('#\A' . $this->sidRegexp . '\z#', $cookie) !== 1), it is removed via service('superglobals')->unsetCookie($this->config->cookieName).

However, if service('request')->getCookie() was called prior to $session->start() (for example, in a before filter such as CSRF), Request::$globals['cookie'] has already cached the cookie array. Because Session::start() did not update Request::setGlobal('cookie', ...) (unlike Security::removeTokenInRequest()), subsequent calls to $request->getCookie($this->config->cookieName) continued returning the invalid session cookie value.

This PR:

• Synchronizes service('request')->setGlobal('cookie', $superglobals->getCookieArray()) and resets $cookie = null when Session::start() unsets an invalid session cookie.
• Adds testStartUnsetsInvalidSessionCookieInSuperglobalsAndRequest() in SessionTest.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide