feat(session): warn about the token_source_priority and use_bearer_token changes in 0.3.9

[allen0099]

Refs #75, #377. The removals themselves stay in 0.4.0; this adds the 0.3.9 notices, since 0.3.9 is the last 0.3.x.

Summary

• Allow cookies in token_source_priority #75: token_source_priority accepts "cookie", but only as the last entry. That is where the cookie is read today, so listing it changes nothing yet; any other position raises a ValidationError. The deprecated SessionMiddleware ignores the entry.
• Allow cookies in token_source_priority #75: FastAPICacheXSessionMiddleware emits a FutureWarning when token_source_priority was set explicitly without "cookie". In 0.4.0 such a list disables the session cookie. The default list does not warn, since 0.4.0's default ["header", "bearer", "cookie"] resolves tokens in the same order.
• 0.4.0: remove SessionConfig.use_bearer_token in favour of token_source_priority #377: passing SessionConfig(use_bearer_token=...) emits a DeprecationWarning, whatever its value. The message names the replacement.
• Docs (EN and zh-TW):
  • SESSION.md: the config reference and the token_source_priority section.
  • MIGRATING_0_4.md: the summary table rows (Allow cookies in token_source_priority #75 now marked FutureWarning, a new 0.4.0: remove SessionConfig.use_bearer_token in favour of token_source_priority #377 row) and the "Token sources" section.
• Changelog: 75.deprecated.md and 377.deprecated.md.

Tests

• tests/session/test_0_4_0_notices.py covers:
  • the warning, and the silence for the default list and for lists that include "cookie";
  • the last-entry rule;
  • that 0.3.9 still reads the cookie with or without the entry;
  • the use_bearer_token warning for True and False, and silence without it.
• The two existing use_bearer_token=False tests now expect the deprecation warning. The "unknown source" tests use "query", since "cookie" is now a known entry.
• Removing the middleware warning call fails 4 tests.
• The full suite passes (coverage 94.59%), pre-commit passes, and both docs builds pass with --strict.