feat: add provider ID to session

[hf]

Adds the provider ID to a session, encoding the provider which was used to initially issue the session.

This allows developers to:

• Revoke sessions issued by a potentially insecure provider.
• Allow us to track the provider in audit logs.
• In the coming Session Control API, it will allow developers to show their users how that session was initially established.

[kangmingtay]

@hf why is this necessary?

[hf]

@kangmingtay It helps us identify which session was issued by which provider. This allows developers to:

1. Revoke sessions issued by a potentially insecure provider.
2. Allow us to track the provider in audit logs.
3. In the coming Session Control API, it will allow developers to show their users how that session was initially established.

[kangmingtay]

@hf the auth.identities table also stores information about a provider. Given that a session is created from one of the user's identity, we can probably associate the identity id to the session.

I would prefer to have a single source of truth for the provider rather than storing this information in the auth.identities table and auth.sessions table