Allow cookies in token_source_priority

[allen0099]

SessionConfig.token_source_priority accepts only "header" and "bearer". Cookie transport is read solely by FastAPICacheXSessionMiddleware, and the response side is a binary decision driven by where the token came from.

Folding cookies into the same priority list today would let ["cookie"] fail silently on the deprecated SessionMiddleware, which has no cookie support. Once #69 removes that class, one priority list can describe all three sources. See docs/SESSION.md.

Proposal

• Extend the literal to Literal["header", "bearer", "cookie"].
• Make the middleware resolve the token by walking the list, and set/clear the cookie on the response according to the source that was used.

Blocked by: #69

[allen0099]

Decisions (2026-09-29)

1. The default becomes ["header", "bearer", "cookie"]. This is exactly how the middleware resolves tokens today, so default configs see no change. The cookie stays last because the browser attaches it automatically (CSRF), while a header token has to be sent on purpose: when a request carries both, the header wins.
2. The list is authoritative. Without "cookie", FastAPICacheXSessionMiddleware neither reads nor sets the session cookie. A request with no token that creates a session gets its token in the header_name response header. This gives API-only apps a way to turn cookies off, which they do not have today.
   • This is a breaking change for anyone who sets token_source_priority explicitly: a custom list such as ["bearer", "header"] stops reading and writing the cookie in 0.4.0. Label breaking-change added.
3. 0.3.9 warns.
   • token_source_priority accepts "cookie", but only as the last entry. That is where the cookie is read today, so listing it changes nothing in 0.3.9, and the deprecated SessionMiddleware keeps ignoring it.
   • FastAPICacheXSessionMiddleware emits a FutureWarning when the list was set explicitly without "cookie". The default list does not warn, since its 0.4.0 replacement behaves the same.
4. use_bearer_token goes away: deprecated in 0.3.9, removed in 0.4.0, tracked in 0.4.0: remove SessionConfig.use_bearer_token in favour of token_source_priority #377.