feat: support upstream IdP session_expiry ceiling (IPSIE SL1)

[kishore7snehil]

📋 Changes

This PR wires up support for the IPSIE SL1 session_expiry claim in auth0-fastapi — an absolute Unix-epoch ceiling an upstream IdP can assert on how long an Auth0 app session may live. The enforcement lives entirely in auth0-server-python; auth0-fastapi delegates to it through the methods it already calls, so bumping the core dependency is what turns the behavior on. The claim round-trips through the encrypted session cookie without any wrapper-side handling.

✨ Features

• Read-time enforcement (inherited): once the ceiling is reached, get_session() / get_user() return None and clear the session cookie, so require_session and the existing redirect-to-login path re-authenticate transparently. get_access_token() raises SessionExpiredError without attempting a refresh. A 30s negative clock-skew leeway is applied.
• Login-time handling (inherited): the ceiling is read from the ID token at /auth/callback and stamped on the session; a login whose ceiling is already in the past is rejected rather than persisted.
• Refresh preservation (inherited): the ceiling stamped at login is preserved across refresh-token grants.

🔧 Dependencies

• Bumps auth0-server-python to >=1.0.0b12, the release that adds session_expiry enforcement.

📖 Documentation

• Adds examples/Sessions.md ("Session expiry from upstream IdP") covering the connection-option prerequisite, how the ceiling behaves in auth0-fastapi, reading the value, and the upgrade null-check note.
• Cross-links it from README.md with a feature entry and a session-expiry section.

🧪 Testing

• This change adds test coverage
• This change has been tested on the latest version of the platform/language

Contributor Checklist

• I agree to adhere to the Auth0 General Contribution Guidelines.
• I agree to uphold the Auth0 Code of Conduct.