Session hardening: renewal cap, cleanup of inactive records, Bearer scheme, cookie attributes

[allen0099]

Smaller session issues found in review.

Split into one sub-issue per pull request:

• Sliding renewal can extend a session past absolute_timeout #164
• clear_expired_sessions() skips expired and invalidated records; batch the deletes #165
• Match the Authorization scheme case-insensitively #166
• Warn when cookie_same_site is "none" without cookie_https_only #167
• Add Vary: Cookie only when the session travels in a cookie #168
• Reuse _stash_session_manager in SessionMiddleware.dispatch #169
• Simple token timestamp forces a re-issued token on every sliding renewal #170 (closed as not planned)