Deprecate session dependency

For `Application` 2.0, we should decouple the `joomla/session` package to allow developers to inject their own session handlers.