Increase CopiWeb.SessionStore coverage with focused branch tests

[Copilot]

The failing Copi CI job was a coverage-gate failure, not a functional regression: total coverage was 93.6% vs. the 95% minimum, with copi_web/session_store.ex called out at 93.1%. This change adds direct tests for the session-store branches that were previously undercovered without modifying production code or runtime behavior.

• What changed

  • Added a dedicated CopiWeb.SessionStoreTest for direct branch coverage of the custom session store.
  • Kept the change scoped to tests under copi.owasp.org/test/copi_web/.

• Cookie-backed session paths

  • Covers get/3, put/4, and delete/3 when PostgreSQL session storage is disabled.
  • Verifies round-trip cookie session persistence and cookie deletion semantics.

• PostgreSQL-backed session paths

  • Covers put/4 storing encrypted session data and returning a cookie containing the PostgreSQL session id.
  • Covers get/3 restoring a valid persisted session.
  • Covers put/4 updating an existing session id and pruning expired rows.
  • Covers delete/3 removing the backing SessionRecord.

• Failure and fallback branches

  • Covers missing cookie / missing session record behavior.
  • Covers expired persisted sessions.
  • Covers invalid encrypted payloads that fail decryption.
  • Covers decrypted payloads that are not valid serialized Erlang terms, exercising the rescue path in decrypt_database_session/1.

• Representative example

  raw_cookie = postgres_cookie(conn, opts, "missing-session")
  
  assert {nil, %{}} = SessionStore.get(conn, raw_cookie, opts)