Validating the security stamp is extending the session if allowRefresh is false

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

In the below resolved issue, you fixed the code so that it does NOT extend the session if slidingExpiration is false.
https://github.com/dotnet/aspnetcore/issues/36373

Should you not also NOT extend the session if allowRefresh is false?

I don't understand the purpose of allowRefresh really.

### Expected Behavior

When the security stamp check is done, the session is not extended if allowRefresh is false, or SlidingExpiraton is false.

### Steps To Reproduce

```
builder.Services.ConfigureApplicationCookie(options =>
{
// Cookie settings
options.Cookie.HttpOnly = true;
options.ExpireTimeSpan = TimeSpan.FromMinutes(10);
options.SlidingExpiration = true;
options.Events.OnSigningIn = (context) => {; context.Properties.IsPersistent = true; context.Properties.AllowRefresh = false; return Task.CompletedTask; };

});

builder.Services.Configure(options =>
{
// Revalidate every 5 minutes instead of 30
options.ValidationInterval = TimeSpan.FromMinutes(1);
options.OnRefreshingPrincipal = async (a) => { Console.WriteLine("SEC STAMP CHECK"); };
});
```

Observe that when the security stamp check occurs, the session is extended.

### Exceptions (if any)

_No response_

### .NET Version

_No response_

### Anything else?

_No response_

Start by reproducing the sample using ConfigureApplicationCookie and Configure, with AllowRefresh=false and a security-stamp validation interval. Compare the observed renewal with the behavior described in issue #36373. Done means the session is not extended during security-stamp validation when either AllowRefresh or SlidingExpiration is false.

Written by the indexing model from the issue text.