fix: isolate Spring session-scoped beans per user in multi-user tests

[totally-not-ai]

Multi-user browserless tests (newUser() -> newWindow()) gave each user its
own VaadinSession, but Spring's @SessionScope/@requestScope beans are resolved
through RequestContextHolder, which is bound to a single request for the whole
test thread (e.g. by Spring's ServletTestExecutionListener). As a result every
user resolved session-scoped beans against the same request, so the second
user reused the first user's instance. When such a bean held a local
ValueSignal, binding it in the second user's UI threw the cross-session
"created in one VaadinSession but accessed from another" IllegalStateException
(issue #110).

Add a per-user RequestContextHandler hook in the shared multi-user lifecycle,
mirroring the existing SecurityContextHandler: BrowserlessUserContext saves the
thread's current binding, binds the active user's request whenever its session
thread-locals are applied (creation, window activation, close), and clears it
on teardown. The Spring integration wires a SpringRequestContextHandler that
binds each user's request to RequestContextHolder via ServletRequestAttributes
(backed by that user's MockHttpSession) and registers the standard request/
session web scopes when missing, so @SessionScope/@requestScope resolve in the
mock environment. The hook is null/no-op for non-Spring (plain/JUnit) contexts.

@VaadinSessionScope already isolated correctly because it resolves against
VaadinSession.getCurrent(); this fix brings Spring's standard web scopes in
line.

[mcollovati]

Overall looks good.

non-blockers:

• should we add a test for RequestScope as well? Does it make sense?
• we should ensure the same feature works for Quarkus as well. Maybe better do it in a separate PR