docs: record the 0.4.0 decisions for #72, #256 and #128 in the migration guide

[allen0099]

Records the 0.4.0 decisions taken in the issue comments, replacing the "not decided yet" lines of the migration guide. There are no code changes.

Summary

• Cache keys do not normalize query parameter order #72 (cache keys): sort_query defaults to True in @cache, build_cache_key() and invalidate(). The guide adds a "What to change" entry for handlers that depend on the query order as sent (sort_query=False, which already works on 0.3.9). HTTP_CACHING.md mentions the coming default.
• 0.4.0: explicit login()/logout() that always rotate the session ID, and __Host- cookie by default #256 (login and logout):
  • await logout(request) is added.
  • Session.user becomes read-only outside login() and create_session(user=...).
  • Data is carried over by default, with an optional keep=.
  • No grace period after a login() or rotate_session_id() rotation.
  • rotate_session_id() keeps its name.
• 0.4.0: conditional session writes so a stale request cannot restore a deleted session #128 (session writes):
  • Ordinary saves become conditional; security actions stay unconditional.
  • A rejected save is dropped and logged, and no token is sent.
  • The concurrent-change side effect is stated explicitly, pointing to Session: merge concurrent changes instead of dropping a rejected conditional save #376.
  • The new set_if_equals primitive has a non-atomic base-class fallback.

This covers both EN and zh-TW. The #75 / #377 guide changes are in #378; the two PRs touch different sections and merge cleanly in either order.