[nexus] Store expiration times on session records

Currently we store sessions with their created time and last used time,

https://github.com/oxidecomputer/omicron/blob/1c53bcd4d7069948838045212ed693f80b8c82a4/schema/crdb/dbinit.sql#L2424-L2430

and then in the authentication code we calculate whether they are expired at runtime based on these config values.

https://github.com/oxidecomputer/omicron/blob/1c53bcd4d7069948838045212ed693f80b8c82a4/nexus/auth/src/authn/external/session_cookie.rs#L132-L171

This is fine for the authentication code because it runs at top level in Nexus and has access to the config (SessionStore is a trait implemented on the ServerContext struct). However, when we list sessions for a user (added in #8479), that query requires us to filter out expired tokens, and we do not have access to the server context all the way down in the datastore crate, so we have to pass it down from the handler. This works but feels very janky and it also has the dubious consequence that session expiration times for existing sessions (worst of all, ones that have already expired but are still in the database) can be changed simply by changing the Nexus config and restarting Nexus.

It would be more solid to store explicit idle and absolute expiration times on the session record, analogous to the time_expires column on the tokens table. Instead of updating the last use time on every use, we would update the idle expiration time. Period. The absolute expiration time would never change after creation.

There is some question around what happens when we add the ability for the operator to change the idle and absolute expiration time (#5477, #7475). The most plausible approach off the top of my head would be to say expiration times can only get earlier, but never later. If the operator shortens the TTL, we update the times on all sessions that become expired as a result of that change, but we would never lengthen the time for existing sessions if they change the TTL to be longer.

https://github.com/oxidecomputer/omicron/blob/1c53bcd4d7069948838045212ed693f80b8c82a4/schema/crdb/dbinit.sql#L2846-L2855