Avoid calling response writers while holding the Jaws lock

[linkdata]

Summary

• keep session ID allocation and registration atomic under jw.mu
• copy the session cookie, then release the lock before calling http.SetCookie or updating the request
• add a regression test with a ResponseWriter that re-enters Jaws through Header, while also verifying registration and cookie propagation

Closes #172.

Verification

• go test -race -run '^TestSession_NewSessionCallsResponseWriterOutsideLock$' .
• go test -race -count=1 ./...
• go vet ./...
• staticcheck ./...
• gofmt
• git diff --check