Fix race in VaadinService.lockSession() (#12282)

The session might be invalidated before lockSession() acquires the lock.
Check if the session is still valid after locking and ensure
SessionExpiredException is thrown if not.

Change-Id: Iad716332a65b7c198427fce5198f6808140c140c