feat: Add opt-in non-exclusive session locking for session receivers - #60060

Adds opt-in non-exclusive session locking to the Service Bus session
receiver, allowing a session that is normally held by a single receiver to be
cooperatively taken over by another receiver. The feature is opt-in and the
default behavior (exclusive session locks) is unchanged, so existing code is
unaffected.

Behavior

Two modes, selected by ServiceBusSessionReceiverOptions.EnableNonExclusiveSession
(default false):

• Exclusive (default). Unchanged. A session is locked to a single receiver
  for the lock duration, and a second accept on the same session fails as it
  does today.
• Non-exclusive (opt-in). With EnableNonExclusiveSession set to true,
  the receiver opts into cooperative locking via the AMQP source filter
  com.microsoft:non-exclusive-session-filter, a composite filter carrying the
  session id and, for a takeover, a lock token. The service echoes the filter on
  the attach response with the assigned session lock token, surfaced read-only
  as ServiceBusSessionReceiver.SessionLockToken. A second receiver presents
  that token via ServiceBusSessionReceiverOptions.SessionLockToken to take
  over the session, then settles the original holder's in-flight messages over
  the management link. The displaced holder's receive link is force-detached by
  the service, so its next operation surfaces SessionLockLostException.

If the connected service does not support the feature, opting in fails loudly
with NotSupportedException rather than silently downgrading. Exclusive
sessions never reach the new code paths.

The scope is ServiceBusSessionReceiver only. ServiceBusSessionProcessor has
no equivalent option and continues to lock sessions exclusively; that is
deliberate, is called out in the CHANGELOG entry, and processor support is
tracked internally.

API

public partial class ServiceBusSessionReceiver : ServiceBusReceiver
{
    // The mode the session was actually established under.
    public virtual bool IsSessionExclusive { get; }

    // Token assigned by the service for a non-exclusive session; null otherwise.
    public virtual string SessionLockToken { get; }
}

public partial class ServiceBusSessionReceiverOptions
{
    // Opt into non-exclusive (cooperative) session locking. Default: false.
    public bool EnableNonExclusiveSession { get; set; }

    // Present an existing session lock token to take over a non-exclusive session.
    public System.Guid? SessionLockToken { get; set; }
}

The token is Guid? on input and string on output, matching the existing
message LockToken, which is likewise a service-provided string.

What changed

• Public API. Four new members across all three TFM API listings: read-only
  IsSessionExclusive and SessionLockToken on the receiver, and settable
  EnableNonExclusiveSession and SessionLockToken on the options. New
  CHANGELOG.md entry.
• AMQP layer. Source-filter wiring for the composite
  non-exclusive-session-filter, carrying session id then lock token
  (AmqpConnectionScope, AmqpClient, AmqpClientConstants,
  AmqpNonExclusiveSessionFilterCodec). AmqpReceiver relaxes the receive-link
  NotFound settlement guard for non-exclusive sessions so the new holder can
  settle the previous holder's messages over the management link.
• Receiver layer. Option plumbing and validation in
  ServiceBusSessionReceiver(Options), ServiceBusReceiver(Options), and the
  transport interfaces. New resource strings for the validation and
  NotSupportedException messages.
• Conventions. cancellationToken moved to the last parameter across the
  internal signatures this touched, and the internal option carriers are now
  get-only with an internal constructor so the shared default-options singleton
  cannot be mutated.

Testing

• Unit tests cover the opt-in validation paths (a lock token requires
  non-exclusive mode, and requires a specific session id so it cannot be
  combined with accepting the next available session), confirm that a
  non-exclusive accept-next without a session id is allowed, and pin the wire
  contract: the filter descriptor name, its code, and that the session id
  encodes before the lock token, so a swapped field order fails rather than
  round-tripping cleanly.
• Live integration tests exercise the end-to-end takeover and cross-receiver
  settlement. The five that depend on the service-side feature are [Ignore]d
  with a reason until the rollout reaches the test namespace, so the live
  pipeline stays green; re-enabling them is tracked internally.
• Full Azure.Messaging.ServiceBus unit suite passes (675 passed, 0 failed).
  dotnet format is clean and the exported API listings regenerate unchanged.