Merge the session endpoints into one domain PR

[PrestaEdit]

Questions	Answers
Branch?	dev
Description?	Consolidates the customer/employee session PRs into one domain PR, with the clear-outdated tests asserting through the list endpoint
Type?	new feature
BC breaks?	no
Deprecations?	no
Fixed ticket?	Related to PrestaShop/PrestaShop#39630
How to test?	See below
Sponsor company	PrestaEdit

What this PR does

Merges #272 and #349 into one PR, following the mutualisation done on the Product domain in #410.

Endpoints

Method	URI	Scope
GET	/customer-sessions	customer_session_read
DELETE	/customer-sessions/{sessionId}	customer_session_write
DELETE	/customer-sessions/bulk-delete	customer_session_write
DELETE	/customer-sessions/bulk-clear-outdated	customer_session_write
GET	/employee-sessions	employee_session_read
DELETE	/employee-sessions/{sessionId}	employee_session_write
DELETE	/employee-sessions/bulk-delete	employee_session_write
DELETE	/employee-sessions/bulk-clear-outdated	employee_session_write

Tests

The two test classes become one SecuritySessionEndpointTest, which is where the merge pays off:

• The clear-outdated assertions now go through the API. Add clear-outdated sessions endpoints (customer + employee) #349 checked its work with SELECT COUNT(*) FROM ps_customer_session WHERE id_customer_session = ..., because it had no list endpoint — Add Security session endpoints (customer & employee: list + delete + bulk delete) #272 has one. Both clear-outdated tests now assert against GET /customer-sessions and GET /employee-sessions.
• They actually verify what the endpoint promises. Each test now seeds a current session alongside the outdated one and asserts the current one is still listed afterwards. The raw count could only tell that the outdated row was gone, not that the endpoint had left everything else alone.
• The leak is fixed. ClearOutdatedSessionsEndpointTest had no resetTables(), so the sessions it seeded stayed in the database for the rest of the suite. It inherits the class-level reset now.
• One seeding helper per entity instead of two copies of the same INSERT, taking the session age as a parameter.

On fixtures: sessions are created by logging in — the domain exposes no "add session" command, so the INSERT itself has to stay. It is the only fixture here that cannot come from the API, and it now lives in a single documented place per entity. A session older than PS_COOKIE_LIFETIME_FO / PS_COOKIE_LIFETIME_BO (480 hours by default) is what "outdated" means for the core, hence the -1 year age.

How to test

GET    /customer-sessions                       -> 200, paginated list
DELETE /customer-sessions/{id}                  -> 204, then it is no longer listed
DELETE /customer-sessions/bulk-delete           -> 204, then none of them are listed
DELETE /customer-sessions/bulk-clear-outdated   -> 204, the outdated one goes, the current one stays

Same four for /employee-sessions. Covered by SecuritySessionEndpointTest.

Supersedes

• Add Security session endpoints (customer & employee: list + delete + bulk delete) #272
• Add clear-outdated sessions endpoints (customer + employee) #349

Both will be closed once the CI is green here.