[Security] Idle sessions expiration.

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | symfony/symfony-docs#4576

This new firewall allows you to block long running sessions.

When the session cookie is valid until the browser is closed (`cookie_lifetime = 0`), but the user left the browser open for a long time, the session will be invalidated if the `max_idle_time` is exceeded. The `max_idle_time` value should be lesser or equal than the one from `session.gc_maxlifetime`.

If an `expiration_url` is set, the user agent will be redirected to this URL after the session invalidation. If this parameter is not set, a `SessionExpiredException` will be thrown.
The way I see to test this without the sleep call is to manipulate the metadata of the session to simulate the session expiration. Do you think it's a good solution? I'm not sure about it. Any other idea? Feedback is welcome.

We could save a second setting `max_idle_time = 1` and sleeping the process only 2 seconds.