docs: record the Spring guarantees of the browserless environment

[mshabarov]

Summary

Two Spring behaviors that a test relies on were not written down anywhere:

• vaadin/browserless-test#111 — in a multi-user test, a @SessionScope or @RequestScope bean is resolved against the active user's own request. Before 1.1.2 every user resolved such a bean against one request, so the second user reused the first user's instance, and a bean holding a local signal failed with the cross-session error. The Pitfalls and Guarantees list covers the security snapshot and the thread-locals, but said nothing about Spring's own scopes.
• vaadin/browserless-test#208 — HttpServletRequest.changeSessionId() used to throw UnsupportedOperationException in the mocked environment, which meant a login flow that protects against session fixation could not run in a test. The mocked request now rotates the ID and keeps the session, its attributes, and the VaadinSession bound to it.

What changed

• multi-user.adoc, Pitfalls and Guarantees — one bullet for the per-user scopes, with the note that @VaadinSessionScope has always behaved this way because it resolves against VaadinSession.getCurrent().
• spring-security.adoc — a Session Fixation Protection section: what rotates the ID, what survives the rotation, and a snippet asserting the new ID.

Notes for the reviewer

• The scopes fix shipped in 1.1.2, which Vaadin 25.2 carries, so that bullet has a V25.2 badge. The session ID rotation shipped in 1.2.0-rc1, hence V25.3 on the new section.
• The session ID section sits on the Spring Security page because that is where authentication in tests is documented, but the rotation itself is not Spring-specific, and the text says so.

How to test

Documentation only, with an inline snippet that is not compiled. The behavior matches MockRequestTest and the multi-user Spring tests on vaadin/browserless-test main.

🤖 Generated with Claude Code