v2.6.1: Enforce immediate expiration of sessions during read

PHP does not enforce `session.gc_maxlifetime` with a custom session handler. Without this explicit check, sessions could remain readable and active even after their `expiresAt` timestamp, relying solely on garbage collection for removal.

This change ensures that any attempt to read an expired session returns an empty string, immediately preventing its use and aligning with the intended session lifetime.