Fix EventPipe keyword/level filter recomputation after session close

[Copilot]

EventPipe maintains aggregate keyword/level filters per EventSource across all active sessions. When a session stops while others remain active, two bugs caused stale filter values — IsEnabled(level, keyword) would return true even when no remaining session matched.

Fixes

Bug 1 — Native (ep-config.c)

config_compute_keyword_and_level included the session being disabled in its keyword/level aggregation. Added a session_to_exclude parameter; callers pass NULL when enabling (no exclusion) and the session pointer when disabling, so the computed values reflect only the remaining active sessions.

Bug 2 — Managed (EventSource.cs, DoCommand)

When a session stops with others still active, the provider callback fires ENABLE_PROVIDER (source still enabled) with bSessionEnable=false. The existing code only handled two cases — first enable (copy) and new session starting (expand via max/OR). It never narrowed the filter when a session stopped. Added a third branch:

• !m_eventSourceEnabled → first enable: copy values
• bSessionEnable → new session: expand (max/OR)
• else → session stopping, others remain: replace m_level/m_matchAnyKeyword with the recomputed values from native (which now correctly exclude the stopping session)

Test

Added KeywordLevelFilterValidation to enabledisable.cs: starts two sessions (Informational+keyword=0x2, Error+keyword=0x1), stops the broader one first, and asserts IsEnabled(Informational, 0x2) is false once only the Error session remains.