Use LRU order for persistent session swaps

[sainadh777]

Summary

• sort active sessions by internal last-access time before enforcing maxActiveSessions
• swap the least recently used eligible sessions first
• add deterministic regression coverage and a changelog entry

Rationale

PersistentManagerBase.processMaxActiveSwaps() previously consumed the manager's unordered session array, so the sessions selected for persistence were arbitrary. This completes the maintained TODO 5.1 item in TODO.md while preserving the existing threshold and eligibility checks.

Impact

Only the victim selection order changes: when the active-session limit is exceeded, older eligible sessions are swapped before newer ones.

Validation

All final gates passed against commit d475a6bf38227a1b3f66a37c3591e79468627c7c.

• JAVA_HOME=/opt/homebrew/opt/openjdk/libexec/openjdk.jdk/Contents/Home ant test -Dtest.entry=org.apache.catalina.session.TestPersistentManager -Dtest.silent=true — passed
• JAVA_HOME=/opt/homebrew/opt/openjdk/libexec/openjdk.jdk/Contents/Home ant -Dexecute.validate=true validate — passed (Checkstyle 13.9.0)
• JAVA_HOME=/opt/homebrew/opt/openjdk/libexec/openjdk.jdk/Contents/Home ant clean — passed
• JAVA_HOME=/opt/homebrew/opt/openjdk/libexec/openjdk.jdk/Contents/Home ant — passed
• JAVA_HOME=/opt/java/openjdk ant test -Dtest.silent=true -Dtest.threads=1 -Dtest.openssl.path=/usr/bin/openssl in an isolated Ubuntu/Temurin 21 container — passed in 27m07s: 649 suites, 41,258 tests, 0 failures, 0 errors, 314 skipped
• generated-distribution smoke test in a fresh init-managed Temurin 21 container — Tomcat started, returned HTTP 200 from /, and stopped cleanly with the server PID exiting

The initial macOS four-thread full-suite attempt hit five multicast tests with NoRouteToHostException, so the complete suite was moved to Linux. Two preliminary four-thread Linux runs each exposed an unrelated timing/parallelism failure (TestTimeBucketCounter; then TestRateLimitFilterWithExactRateLimiter plus a fixed-port standalone fork conflict); every affected test passed alone. The final unfiltered Linux run above used one test thread and passed completely.

[sainadh777]

@remm, would you be willing to review this? You have the most recent changes in these session-manager paths. This completes the checked-in TODO 5.1 item with focused regression coverage.