feat(serializer): pure-PHP session-data serializer

[ralflang]

NativePhpSessionSerializer wraps session_encode and session_decode.
Both functions only operate on the active PHP session via the session
module. Modern PSR-15 routes that own their session lifecycle through
SessionLifecycle and middleware never call session_start, so the
native serializer cannot read or write rows for them.

PhpTextSessionSerializer implements PHP's default php
session.serialize_handler format directly. Layout is a flat
concatenation of |<serialize($value)> records. Reader uses the
re-serialize-and-measure trick to advance past each record because
unserialize does not report bytes consumed.

DefaultSessionSerializer dispatches to PhpTextSessionSerializer for
session.serialize_handler=php and to PhpSessionSerializer for
php_serialize. Other handlers (igbinary, custom) raise a clear error
at construction. The handler is captured at construction time and
frozen, matching how PHP's session module reads the ini once on open.

Both formats produce the exact byte sequence that PHP's session
module produces on the same payload, so legacy callers that go
through session_start continue to read and write the same on-disk
rows. Modern and legacy stacks share storage.