Prevent shared caching of session cookie responses

[linkdata]

Summary

SessionMiddleware creates a session on every cookie-less route it wraps. With a broadly wrapped mux, the built-in CSS and JS handlers can replace an earlier cache policy with a public one while the response still carries Set-Cookie.

When the middleware creates a Session, protect its cookie at header commit with Cache-Control: no-store. Requests with an existing Session use the original response writer and keep the handler's cache policy, so ordinary asset requests remain publicly cacheable. This covers explicit writes, flushes, implicit 200 responses, and WebSocket upgrades. Applications that create or rotate Sessions directly remain responsible for their own response cache policy.

Fixes #399.

Validation

• go test -race ./...
• go vet ./...
• go build ./...
• gosec -quiet ./...
• gofumpt -l session.go session_test.go

Package race coverage is 99.7%; the session response writer methods are fully covered. BenchmarkSessionMiddlewareExistingSession measures the existing-session path with a 204 response. Six runs per version, compared with benchstat:

Measure	Before	After	Change
Time/op	89.95 ns	75.14 ns	−16.46%
Bytes/op	32	8	−75%
Allocs/op	2	1	−50%

golangci-lint is not installed here. The installed staticcheck reports that ./... matches no packages.