REF-30: Change the session id when a login is accepted

[thomasnymand]

Gives the session a new id when a login is accepted.

Problem

The validated assertion was stored on whatever session the browser already had. The container session id was never rotated across the authentication boundary, so an id present before login stayed valid as an authenticated session afterwards, which is what session fixation relies on.

Changes

• AssertionHandler changes the session id once validation has passed and before the assertion is stored.
• Session state is keyed on the container session id, so the in-flight AuthnRequest is stored again under the new id. Without that the session looks unauthenticated to AuthenticatedFilter and the user is sent straight back to the IdP.

Breaking: the library now requires Servlet 3.1

HttpServletRequest.changeSessionId() is Servlet 3.1, so javax.servlet-api goes from 3.0.1 to 3.1.0. Consumers on a Servlet 3.0 container will need to move to 3.1 or later; worth a line in RELEASE_NOTES.md at release time.

Consequences in this repository:

• The demo ran on tomcat7-maven-plugin, which is Servlet 3.0. It now runs on jetty-maven-plugin 9.4 with the HTTPS connector configured in demo/src/main/jetty/jetty-https.xml, reading the existing misc/ssl-demo.pfx keystore. The run command is now mvn clean install followed by mvn -pl demo jetty:run-war, as documented in the README.
• Three test stream stubs had to implement the methods Servlet 3.1 added to ServletInputStream and ServletOutputStream.

Verification

mvn -pl oiosaml test → 113 tests, 1 failure: the pre-existing OIOBPPUtilTest (JDK 26 JAXB incompatibility), which also fails on master.

The new test asserts the ordering: session id changed, AuthnRequest stored again, assertion stored. With AssertionHandler reverted it fails.

The demo was started on Jetty and checked over TLS: https://localhost:8443/oiosaml3-demo.java/ returns 200 and /saml/metadata serves the SP metadata.

Note that mvn install at the reactor level stops in the idp module. That failure is present on unmodified master as well and is unrelated to this change.