feat: auth sessions

[jmikrut]

Adds full session functionality into Payload's existing local authentication strategy.

It's enabled by default, because this is a more secure pattern that we should enforce. However, we have provided an opt-out pattern for those that want to stick to stateless JWT authentication by passing collectionConfig.auth.useSessions: false.

Todo:

• @jessrynkar to update the Next.js server functions for refresh and logout to support these new features
• @jessrynkar resolve build errors

[DanRibbens]

Looks good.

[denolfe]

Setting useSessions: false doesn't appear to be getting respected.

[denolfe]

Needs to be retested after merging main

[DanRibbens]

Looks good! We just need to edit that description before merging and be explicit about the migration as some may consider it a breaking change unless you opt out.

[github-actions]

🚀 This is included in version v3.44.0

[HarleySalas]

Thank you! Payload auth felt like stateless auth trying to roleplay as stateful auth for me. I'm very happy to see this change!

[yonnic]

guys really ?? why introducing breaking changes ? this session option should be off by default !

now i have a broken production with users not able to login, i see no migration for mongodb ?!?
so i turned off the sessions

This is a bad practice, not everyone is reading release notes on every commit.

[mydansun]

Hi @jmikrut @DanRibbens

It looks like this update happens directly without respecting the beforeChange hook on the apiKey field:

payload/packages/payload/src/auth/baseFields/apiKey.ts

Line 31 in 14612b4

beforeChange: [encryptKey],

This might be related to the following issue as well:
#13063