fix: Sanctum middleware config mutation

[binaryfire]

This PR cleans up Sanctum so it no longer mutate's configuration per-request. It also refactor's the previous extension point we added to a static method so it can be set in a service provider.

Summary

• Add StartSession::configureSessionCookieUsing() so session cookie attributes can be customized per request from a service provider, without subclassing the session middleware.
• Move Sanctum's stateful frontend cookie hardening onto that hook instead of mutating the global config repository during request handling.
• Add static-state cleanup for the new session callback registry and SanctumGuard macros, with regression coverage for cookie hardening, callback composition, and test isolation.

Details

Sanctum previously called config() from EnsureFrontendRequestsAreStateful::handle() to force session.http_only = true and session.same_site = lax. That is safe in Laravel's request model, but not in Hypervel workers: the config repository is process-global, so request-time writes can leak into other requests handled by the same worker. Technically it wasn't causing problems but it's a worthwhile correctness cleanup.

This PR keeps Sanctum's behavior without the global mutation. StartSession now supports boot-time registration of request-aware cookie configuration callbacks:

StartSession::configureSessionCookieUsing(function (Request $request, array $cookie): array {
    return array_replace($cookie, [
        'domain' => tenant()->sessionCookieDomain(),
    ]);
});

Callbacks run when the session cookie is written, receive the current request and current cookie configuration, and compose in registration order. Sanctum registers one of these callbacks during provider boot and only applies its http_only / same_site hardening when the existing Sanctum request attribute is present.

This also replaces the older protected-method extension point. Customizing session cookie attributes no longer requires creating a child middleware class and swapping it into the middleware stack; apps can now configure the behavior directly from a service provider, which is closer to Laravel's ...Using() extension style and easier to use for multi-tenant cookie settings.

Tests

• ./vendor/bin/phpunit tests/Session/Middleware/StartSessionTest.php
• ./vendor/bin/phpunit tests/Session
• ./vendor/bin/phpunit tests/Sanctum/EnsureFrontendRequestsAreStatefulTest.php tests/Sanctum/FrontendCookieHardeningTest.php tests/Sanctum/SanctumGuardStaticStateTest.php
• ./vendor/bin/phpunit tests/Sanctum
• ./vendor/bin/phpunit tests/Session tests/Sanctum
• ./vendor/bin/phpstan analyse src/session/src src/sanctum/src tests/Session/Middleware/StartSessionTest.php tests/Sanctum tests/AfterEachTestSubscriber.php