0.4.0: remove SessionConfig.use_bearer_token in favour of token_source_priority

[allen0099]

Problem

There are two ways to turn off Authorization: Bearer tokens: SessionConfig(use_bearer_token=False), or leaving "bearer" out of token_source_priority. _read_header_token checks both. Once #75 makes token_source_priority the single list of token sources (header, bearer, cookie), the boolean only duplicates it.

Plan

• 0.3.9: SessionConfig emits a DeprecationWarning when use_bearer_token is passed explicitly, True or False. The message names the replacement:
  • use_bearer_token=True: drop the argument, since it is the default.
  • use_bearer_token=False: leave "bearer" out of token_source_priority, keeping "cookie" in the list (see Allow cookies in token_source_priority #75).
• 0.4.0: remove the field. Bearer tokens are read if and only if "bearer" is in token_source_priority.
• Update the migration guide table and section, the changelog fragment, docs/SESSION.md and the zh-TW mirrors.

[allen0099]

Note for the implementation, found while looking into #412: a SessionConfig subclass can declare use_bearer_token: bool = False as a class default, and the 0.3.x DeprecationWarning never fired for that, because it only checks model_fields_set. Once 0.4.0 removes the field, such a subclass does not fail: its annotation declares a new field of its own, which the library no longer reads, so bearer tokens are silently read again.

docs/MIGRATING_0_4.md (and the zh-TW copy) should tell subclass users to remove the declaration and leave "bearer" out of token_source_priority instead. The same section could remind them to check a subclass token_source_priority default for "cookie" (#75), since that case did not warn either.