DBSC: share source scheme ITicketStore (server-side revocation) with derived cookies

## Summary

Follow-up from PR #67388 (device-bound sessions / DBSC). The DBSC feature derives short-lived **session** and long-lived **refresh** cookie schemes from a source cookie authentication scheme.

PR #67388 forwards the source scheme's `OnValidatePrincipal` onto the derived refresh cookie (see review thread https://github.com/dotnet/aspnetcore/pull/67388#discussion_r3582039976), which enforces the **event-based** revocation path (e.g. ASP.NET Core Identity's security-stamp check) at refresh time.

What remains uncovered is the source scheme's **server-side** revocation path via `CookieAuthenticationOptions.SessionStore` (`ITicketStore`). If an application configures server-side ticket storage on the source scheme, revoking the source ticket does **not** invalidate the DBSC-derived session/refresh cookies, because the derived schemes do not share that store.

## Details

- `CookieAuthenticationOptions.SessionStore` is the `ITicketStore` used for server-side ticket storage/revocation.
- `CookieAuthenticationHandler` uses it to retrieve a ticket by session key and `RemoveAsync` it on failure/sign-out, and `StoreAsync`/`RenewAsync` on sign-in.
- `PostConfigureDeviceBoundSessionDerivedCookieOptions` copies cookie attributes and now forwards `OnValidatePrincipal`, but does not wire up `SessionStore` for the derived schemes.

## Open design questions

1. Reuse the same `ITicketStore` instance on the derived schemes vs. link derived tickets to the source session key so a source `RemoveAsync` cascades.
2. Key-linking strategy — derived cookies currently carry their own ticket/session key, so a naive share won't cross-invalidate.
3. Interaction/ordering with the `OnValidatePrincipal` forwarding already in place.
4. Whether server-side ticket storage is in scope for the DBSC prototype (the design doc lists "fully stateless, no server-side session store required" as a goal) or a later milestone.

## Related

- PR: #67388
- Review thread: https://github.com/dotnet/aspnetcore/pull/67388#discussion_r3582039976

Start with CookieAuthenticationOptions.SessionStore and CookieAuthenticationHandler, then read PostConfigureDeviceBoundSessionDerivedCookieOptions and PR #67388. Trace how source and derived cookies store, retrieve, renew, and remove tickets, including the forwarded OnValidatePrincipal behavior. Done means an agreed design and coverage showing source-ticket revocation invalidates the derived session and refresh cookies.

Written by the indexing model from the issue text.