Update app auth config session ID generation to include a prefix

[gabrielcorado]

Raised in this thread.

With the addition of app auth config sessions, we can now generate session IDs from other values (using SHA256) instead of having them generated using a "crypto-strong pseudo-random generator". This change increased the chances of conflicting session IDs. Although the chances are still small, a conflict would cause the session to be overwritten, and existing clients would access a different session.

Given this, in this PR, we add a non-hex prefix to app auth config sessions, eliminating the chance of conflicting with regular app sessions.

IMPORTANT: The regular app session IDs remain unchanged, and this affects only sessions using app auth config.

Manual Test Plan

Test Environment

The environment requires using the branch from #62975, which introduces MCP sessions using app auth config. The test environment used was the same as the other PR; you can check there for more details.

With that setup, we need to generate a few (tested with 5) sessions (by starting the MCP client).

Test Cases

For each audit storage backend:

• PostgreSQL (pgevents)
• Athena (athena)
• Firestore (firestoreevents)
• DyanamoDB (dynamoevents)
• Filelog (filelog)

The following was tested:

• WebUI list audit events
• WebUI list session recordings
• WebUI watch SSH session recording
• tsh recordings ls
• tsh play ssh-session-id

Although programmatically those other parts are not affected, I also tested them since touch audit events:

• Events handler export to Fluentd (doesn't unmarshal/inspect app sessions IDs, but it is on the events).
• tsh play -f json chunk-id (doesn't directly use the session ID, but has it on the events)

[greedy52]

The prefix includes a non-hex character ("u")

interesting. so his allows us to keep the same length? any other alternative name than auth?

[gabrielcorado]

Yes, we keep the same length. We could use anything that is non-hex, including a single character (for example, zXXXX). I've left it as auth so we have both a descriptive indicator and also avoid conflicts with regular app sessions, but I'm open to suggestions.