[Kernel] ensure session is saved before sending response

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #6417, #7885
| License       | MIT
| Doc PR        | n/a

Saves the session, in case it is still open, before sending the response.

This ensures several things in case the developer did not save the session explicitly:

- If a session save handler without locking is used, it ensures the data is available
on the next request, e.g. after a redirect. PHPs auto-save at script end via
session_register_shutdown is executed after fastcgi_finish_request. So in this case
the data could be missing the next request because it might not be saved the moment
the new request is processed.

- A locking save handler (e.g. the native 'files') circumvents concurrency problems like
the one above. By saving the session before long-running things in the terminate event,
we ensure the session is not blocked longer than needed.

- In case of a regenerated session ID locking cannot help. So it this case, the session
must be saved anyway before sending the response to not be logged out after just
logging in.

@stloyd thanks. I fixed it.