Changed VaadinSession locking to be based on a session attribute (#8894)

Locking of a VaadinSession is now done in VaadinService using the underlying HTTP session. This enables locking of the VaadinSession even before it has been created.

Change-Id: I815d08d1fb74a1d0905c58b190bb10aa2161a834