[FEATURE] Session Management APIs

Problem

Active user session management (listing logged-in users, killing sessions) is currently only accessible via DWR calls to UserSessionAjax. Need REST endpoints to answer "Who's logged in and how do I manage sessions?" with proper security (HMAC-obfuscated session IDs, CSRF protection).

Goal

Provide REST endpoints for listing active sessions, killing individual sessions, and killing all sessions. Session IDs must never be exposed to the client — use HMAC obfuscation with time-limited CSRF tokens, matching the security model of the existing DWR implementation.

APIs

• GET /v1/maintenance/_sessions — List active user sessions with obfuscated tokens
• DELETE /v1/maintenance/_sessions/{token} — Kill specific session by HMAC token
• DELETE /v1/maintenance/_sessions — Kill all sessions except caller

Personas

• Developer Teams — Need REST APIs for Angular Logged Users tab
• System Administrators — Need to monitor and manage active user sessions

Legacy Reference

• DWR Class: com.dotcms.cmsmaintenance.ajax.UserSessionAjax
• JSP: view_cms_maintenance.jsp lines 783–888 (Logged Users tab)
• Security: HMAC-SHA256 obfuscation with 15-minute CSRF token expiry
• Target Class: MaintenanceResource.java (/api/v1/maintenance)

Start with MaintenanceResource.java under /api/v1/maintenance and compare the existing behavior in com.dotcms.cmsmaintenance.ajax.UserSessionAjax and view_cms_maintenance.jsp lines 783–888. Verify the three listed endpoints, HMAC-SHA256 token obfuscation, and 15-minute CSRF expiry against the legacy security model. Done means active sessions can be listed, individually killed, or all killed except the caller without exposing session IDs.