Reduce lifetime of remember me sessions

This is a meta discussion somewhat related to the changes introduced in flarum/framework#2651

Due to the garbage collector issue flarum/framework#2075 the session duration was never properly enforced, so most people probably have no idea of the default lifetimes we backed in.

Basically the current remember session duration is as follows:

- The token expires 5 years after the last activity
- The cookie expires 5 years after login

Disregarding the mismatch between the two, I think 5 years is too long. It makes no sense to keep a session active that long **without any activity**.

I would suggest we scale it down to a value somewhere between 3 months and a year.

As we make it shorter, the need to fix the mismatch between database and cookie will become more important. I'm suggesting we do something similar to cookies where a middleware checks if the session's token is a remember token, and sets the cookie again with a new expiration on every request. Prior to the access token refactor this wasn't very easy, but now it will be something relatively easy to implement.