Allow WebFilter subclasses to override HazelcastHttpSession creation

Split of creation of new HazelcastHttpSession instances to a protected method
to allow subclasses to return a customized version of HazelcastHttpSession.

We use `WebFilter` in an application where plugins (OSGI bundles) can access the
`HttpSession`. When these plugins store attributes in the session, we need to wrap
those attributes in a wrapper object to also persist the OSGI bundle information.
This allows us to set the correct class loader before deserializing the session attribute.

Here's how we'd override it

```
public class OsgiSafeWebFilter extends WebFilter {

    public OsgiSafe() {
    }

    public OsgiSafe(Properties properties) {
        super(properties);
    }

    /**
     * Extends Hazelcast's {@code HazelcastHttpSession} to wrap all attributes in a
     * {@link com.atlassian.hazelcast.serialization.OsgiSafe} wrapper. This ensures 
     * that plugins can safely store their data safely in the session without running into
     * class loading issues.
     */
    protected class OsgiSafeHazelcastHttpSession extends HazelcastHttpSession {

        public OsgiSafeHazelcastHttpSession(String id, HttpSession originalSession, boolean deferredWrite) {
            super(id, originalSession, deferredWrite);
        }

        @Override
        public Object getAttribute(String name) {
            return unwrap((OsgiSafe) super.getAttribute(name));
        }

        @Override
        public void setAttribute(String name, Object value) {
            super.setAttribute(name, wrap(value));
        }
    }
}

```