feat: HTTP handler use cookie to pass session id to and from clients.

[youngsofun]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

• a part of HTTP handler and clients use cookie to share session id. #16720
• add endpoint /v1/session/heartbeat, /v1/session/refresh now only used for refreshing session token
• also use cookie to store last access time, thus can easily control the interval of refreshing server state.
• rename need_refresh to need_keep_alive: client need to logout and heartbeat (if need to be idle for more than 4 hours) when it is true.
• login support disable_session_token
• fix logout to drop_client_session_state

after this pr, we can first add cookie support and logout to clients to make temp table availble

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is