feat: Change session manipulation methods from private to protected

[michalsn]

Description
This PR changes the session manipulation methods from private to protected, so we can use them if we extend the Authentication\Authenticators\Session class.

Reference: #1111

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[kenjis]

This Session class is already very long, and would violate the SRP.
Don't we need a new class for these methods?

[michalsn]

The methods related to the user session will give us about 50 lines of code. I don't see the point of moving them to a separate class - especially if they are to remain non-public.

[kenjis]

The session data manipulation is needed only for the Session authenticator.
So extracting them into a class does not seem to help much in the future.
If we extract classes, we should extract another functions, but so far there is no need.

By the way, is this an enhancement or a bug fix?
In other words, should the next release be minor version up?

[michalsn]

I would say this is an enhancement.

[kenjis]

Then it should be released as v1.1.0.

[michalsn]

Okay. I'm not familiar with the Shield release cycle, so it's up to you when you'd like to merge this.