fix: bound resync detection state kept in the session

[caalador]

Keep the last clientId of all UIs
in one session attribute, capped at
32 UIs with the oldest dropped first,
instead of one attribute per UI id.
UI ids that are not numeric are no longer stored.

Related: #430

[heruan]

Heads up: #415 (approved) removes the resync detection filters and the session state this PR bounds, so this change will not be needed once it lands. Maybe keep this on hold until #415 is merged.

[Artur-]

Can #415 be backported, i.e. are the events in Flow 25.3?

[caalador]

The events are not in 25.3 as far as I know so this PR is mainly targeted at 5.0 that doesn't get the events.

[heruan]

Makes sense, thanks. Then this should target 5.0 and build on #447 instead of main. One thing to check there: all UIs now share one map that each request copies and writes back. If two tabs post at the same time and the filters lock different objects (for example a new HttpSession wrapper per request), one write can undo the other and a resend goes uncounted.

[caalador]

Rebased on 5.0 and the shared map is fixed so that two tabs posting at the same time no longer undo each other's stored clientId.

[caalador]

Closing PR as #449 changes make this not needed anymore.