feat(EphemeralSessions): Introduce lax period

[artonge]

In an attempt to fix the numerous number of issues with ephemeral session, I suggest that we introduce a lax period of 60 seconds during which no request will close the session.

For the record, we had/have the following problematic requests:

• side menu https://gitnet.fr/deblan/side_menu/issues/443
• encryption fix(encryption): Do not load encryption js on login #56104
• custom background: [Bug]: Setting a custom background image would cause login loop in Login Flow v2 #56131
• two factor fix(2fa): Fix 2FA session setup when ephemeral session is used #54605
• and I think a last one that I cannot remember.

[nickvergessen]

Other apps were:

• guests
• pride_flags
• richdocuments
• integration_youtube

[nickvergessen]

So first minute is good, but longer still runs into problems if it happens during the login flow?

I'm not sure we are overestimating peoples speed with passwords manager and 2FA auth a bit.

Should we bump the limit a bit higher to be "save"?

[artonge]

Should we bump the limit a bit higher to be "save"?

Yes, given that this feature only protects against leaving an open session behind, I think it is safe to bump it to 5 min.
1 min was the diplomatic middle ground :).

[artonge]

/backport to stable32

[artonge]

/backport to stable31

[artonge]

/backport to stable30

[artonge]

/backport to stable29

[artonge]

/backport to stable28

[artonge]

/backport to stable27

[artonge]

/backport to stable26

[artonge]

/backport to stable25