feat: deprecate session and OAuth state, to be removed in 0.5.0

[allen0099]

Closes #420.

fastapi_cachex.session and fastapi_cachex.state are deprecated in 0.4.0 and will be removed in 0.5.0 (#421). The package narrows to HTTP and application caching.

What changes

• Importing fastapi_cachex.session or fastapi_cachex.state, or reading one of their names from fastapi_cachex, emits a FutureWarning once per process. The warning points at the application's own line, not at a frame inside the package or the import machinery, and links to the new migration section.
• A plain import fastapi_cachex stays silent. The top-level session/state names are resolved lazily through a module __getattr__, are no longer in __all__, and are still visible to type checkers through a TYPE_CHECKING block. cache.py no longer imports session.config.
• The 0.4.0 changes announced for sessions are dropped, since they would make users migrate twice:
  • 0.4.0: resolve get_session_manager through SessionManagerProxy #131: get_session_manager no longer warns about the proxy fallback.
  • Allow cookies in token_source_priority #75: the middleware no longer warns when token_source_priority omits "cookie".
  • 0.4.0: remove SessionConfig.use_bearer_token in favour of token_source_priority #377: use_bearer_token stays deprecated and is now removed in 0.5.0 along with the package.
• Docs: MIGRATING_0_4.md has a new "Sessions and OAuth state are deprecated" section with alternatives (Starlette SessionMiddleware / starsessions, Authlib, auth-stack tokens). The session, state and JWT pages get a deprecation banner, and the nav, README and site description are updated. The zh-TW translation follows.
• SECURITY.md: session and state receive security fixes only during 0.4.x.
• Changelog fragment changelog.d/420.deprecated.md.

Tests

• tests/test_session_state_deprecation.py runs each import style in a subprocess and asserts the warning's file and line. It also checks that every core module imports without a FutureWarning, that state does not import session, and that the TYPE_CHECKING imports match the lazy-name table.
• tests/session/test_dropped_0_4_0_changes.py asserts the dropped notices stay silent.
• pytest ignores the two deprecation messages globally, so the existing session/state tests and examples/ run as before. The warnings themselves are covered by the subprocess tests, not by test_examples.
• Mutation-checked: re-adding a session/state import to a core module, dropping a TYPE_CHECKING line, or restoring the old notices each makes the guarding tests fail.

An independent review agent reviewed the change before this PR. Its findings are addressed in the second commit.