Exclude bots from session tracking

[jeffputz]

Bots are an enormous portion of traffic now. This impacts the app in several ways:

• The user session counts (as viewed on the home page) are insanely skewed.
• Since the bots don't accept the session cookie, a new one is issued for every request.
• This creates a ton of noise in the security audit log, and excessive writes and deletes on the session persistence.
• Aggravates the ASPNET bug (Bots causing null ref exception in TopicViewCountService when trying to fetch cookies #210, DefaultHttpResponse throws null ref when trying to access Cookies, even when using null check, only from bots dotnet/aspnetcore#25454).

[jeffputz]

0eccf19

[jeffputz]

We're filtering by user agents, so the limitation we have is that we miss any machines not willfully identifying as bots. Initial experimentation in a production environment shows this is still remarkably effective.