feat(session): Add session.user_data for arbitrary per-session data

[cpsievert]

Ports session$userData from Shiny for R: a plain dict, created per session
and shared with module sessions, for session-specific state that isn't
reactive.

Why

Code that only has a session (a helper, a package, a module) has had nowhere
to keep per-session state. Some things it unlocks:

• Authentication. Stash a user's OAuth access token or viewer credentials
  once, and any module or helper can call an API on their behalf. It doesn't
  need to be passed through every signature, and it never triggers
  invalidation or lands in a bookmark the way a reactive.Value would.
• Per-session resources. Open a DB connection or API client lazily, once
  per session, and close it in session.on_ended.
• Non-reactive caches. Memoize an expensive per-user lookup or model
  without creating reactive dependencies.
• Run-once setup. Guard per-session initialization with
  if "x" not in session.user_data.

def server(input, output, session):
    session.user_data["token"] = fetch_token(session.http_conn.headers)

@module.server
def orders(input, output, session):
    client = ApiClient(token=session.user_data["token"])

Use a reactive.Value instead if the data should drive the UI.

Behavior

• Not reactive; released with the session, and still readable in on_ended.
• Modules share the root session's dict.
• Mutate in place. Assigning a new dict raises AttributeError, as R forbids
  reassigning userData.

Also adds a section to the bundled shiny-for-python agent skill.