feat: add support for anonymous sessions - #156

Changes

Added

• Adds ServerClient.anonymous for pre-login anonymous sessions: create_session,
  get_token, introspect, and logout. Gives a visitor a persistent anon@<uuid>
  identity plus a short-lived access token before they authenticate, with up to 1 KB of metadata attached at
  creation. Framework-agnostic RWA core — mounts no routes and sets no cookies.
  identifier, isolated from the authenticated _a0_session store. AnonymousSession never
  exposes the raw session token to the caller.
• Adds a token renewal ladder on get_token: fresh cached access token is returned;
  expired access token is re-minted with the session token; an expired or invalid session
  token silently creates a brand-new session, once, surfaced via
  AnonymousSession.is_new. Metadata is lost and sub changes on that silent re-mint — this
  never raises, since an anonymous pre-login session carries no authorization.
• Injects the anonymous session_token into start_interactive_login() automatically when
  a session is active, sourced only from the SDK's own encrypted store and bound into
  TransactionData under the existing state binding.
• Adds typed anonymous option/response models (AnonymousSession,
  AnonymousTokenResponse, AnonymousSessionContext, AnonymousSessionIntrospection) and a
  typed error hierarchy under AnonymousApiError, including five config subclasses
  (AnonymousFeatureNotEnabledError, AnonymousClientNotEnabledError,
  AnonymousClientNotSupportedError, AnonymousResourceServerError, AnonymousScopeError)
• Enforces metadata safeguards client-side before any network call: rejects dangerous keys
  (__proto__, constructor, prototype) and enforces a 1 KB (UTF-8 JSON) size cap.

Testing

As part of manual testing following flows have been completed:

Happy Path

1. Create — POST /anonymous/session mints an anon@<uuid> identity; returns session_token (opaque JWE, ANONYMOUS_SESSION_ prefix) + access_token (RS256 JWS, audience-bound).
2. Get token — GET /anonymous/session walks the renewal ladder: cached → re-mint via session_token → silent new session.
3. Login injection — GET /anonymous/login-url confirms session_token is auto-injected into /authorize (session_token_injected: true), no call-site change.
4. Logout — POST /anonymous/logout best-effort calls /anonymous/logout, then always clears local store; post-logout GET returns AnonymousTokenError (fail-closed). Issued access tokens self-expire (not
   revoked).

Negative / Fail-Closed

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors