[Security] Idle sessions expiration.

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | symfony/symfony-docs#4576

This new firewall allows you to block long running sessions.

When the session cookie is valid until the browser is closed (`cookie_lifetime = 0`), but the user left the browser open for a long time, the session will be invalidated if the `max_idle_time` is exceeded. The `max_idle_time` value should be lesser or equal than the one from `session.gc_maxlifetime`.

If an `expiration_url` is set, the user agent will be redirected to this URL after the session invalidation. If this parameter is not set, a `SessionExpiredException` will be thrown.
I know that sleeping down the tests is not a good practice, but I've found some examples in [Symfony/Component/Process/Test/AbstractProcessTest.php](https://github.com/symfony/symfony/blob/2.7/src/Symfony/Component/Process/Tests/AbstractProcessTest.php)

I can reduce the slow down to only 1 second changing the comparision operator in the `hasSessionExpired` from `>` to `>=` as suggested by @desarrolla2.

What do you think?