chore(deps): use api7-lua-resty-session to fix empty arrays in OIDC userinfo

[AlinsRan]

Description

Fixes #13440

The shared cjson instance in `lua-resty-session` (`lib/resty/session/utils.lua`) decodes JSON without the array metatable. An empty array therefore loses its array identity across the session save/load cycle and is re-encoded as an object.

With `openid-connect`, userinfo is stored in the session and read back on subsequent requests, so an empty claim such as `roles` comes back as a plain empty table and `core.json.encode` renders it as an object:

IdP userinfo : {"sub":"a UID","name":"Testuser One","roles":[]}
X-Userinfo   : {"sub":"a UID","name":"Testuser One","roles":{}}   <- roles became an object

Note the corruption is not in openid-connect or in openidc's own decode: core/json.lua enables decode_array_with_array_mt(true) on the shared cjson.safe singleton, which openidc reuses, so the array survives into the session. It is lost on the way out, in lua-resty-session's own cjson.safe.new() instance, which does not have that option set.

Fix

Switch the dependency to api7-lua-resty-session = 4.1.6-0, which enables decode_array_with_array_mt on that instance (upstream PR: bungle/lua-resty-session#207).

lua-resty-openidc (>= 4.0.3) and lua-resty-saml (= 4.1.5-1) still declare the upstream lua-resty-session, so it is still installed transitively. That is fine: LuaRocks gives the canonical module path to the lexicographically smaller rock name (luarocks/repos.lua, name < cur_name), so api7-lua-resty-session owns resty.session.* and the upstream copy is relegated to a versioned directory that nothing requires. This is exactly the arrangement already used by api7-lua-resty-http and api7-lua-resty-jwt, which coexist with the upstream rocks pulled in by openidc.

Verification

Resolving the dependency set (api7-lua-resty-session + lua-resty-openidc + lua-resty-saml) into a clean tree:

installed    : api7-lua-resty-session, lua-resty-openidc, lua-resty-saml, lua-resty-session
canonical    : share/lua/5.1/resty/session/utils.lua  -> has decode_array_with_array_mt
relegated    : share/lua/5.1/lua_resty_session_4_1_5_1-resty/   (upstream, unreferenced)

Replaying the userinfo round-trip through that tree:

require resty.openidc : ok
session stored        : {"roles":[],"sub":"a UID","name":"Testuser One"}
X-Userinfo            : {"roles":[],"sub":"a UID","name":"Testuser One"}

The result is independent of install order, since the winner is decided by rock name rather than by installation sequence.