CodeQL flags the session id's header-to-log flow on every PR that touches it #1533

Problem

CodeQL flags the flow of a session ID from a request header into the session store's log lines:

• go/log-injection (medium)
• go/clear-text-logging (high)

It reports them at:

• core/session/affinity.go:86
• core/session/archive/archive.go:358
• core/session/store.go:1474

This flow exists on main today: forwardproxy/server.go resolves the session with recordingSessionID(sessionID, r.Header, chain) and passes it to the store. It goes unflagged because CodeQL runs only on pull requests, and there it reports only paths that pass through changed lines. Any PR that edits code on that path will raise the same six alerts again. #1467 did, and they were dismissed as false positives.

Why they are false positives

• Log injection: session.IDHeaderFrom refuses any header id containing a control character (validHeaderSessionID, which uses unicode.IsControl), so a line break cannot reach a log line. Cortex also logs through slog's text handler, which quotes such values.
• Clear-text logging: CodeQL treats every request header as sensitive. A session id is not a credential.

Fix

Make the validation something CodeQL recognises as a sanitizer, at the source, so no future PR trips over it. For example:

• Log injection: have IDHeaderFrom return the id through strings.ReplaceAll(id, "\n", …) / "\r", which CodeQL treats as a log-injection sanitizer. The string is unchanged, since the validation already guarantees there are no line breaks.
• Clear-text logging: read the header with Header.Get and a constant header name where possible. CodeQL treats a non-Authorization/Cookie Header.Get as non-sensitive. The configured header list (session.id_headers) may make this harder; if it does, a model-pack barrier or a path-scoped query-filters entry in .github/codeql/codeql-config.yml with a written reason is the fallback.

Done when a PR that touches recordingSessionID or the store's logging raises none of these alerts.

Refs #1467.