webapp-session-state-to-stateless

Classify every recovered HttpSession / ActionForm session-scope / @SessionAttributes / session-scoped bean attribute into one of five stateless destinations, and decide the auth strategy (shim vs. replace) the target HLA names. First-class in v1, not deferred — a flow can't be marked migrated while any of its session attributes is unclassified or still read from HttpSession by the new code. Use after the webapp-target readers have recovered session attributes, before a flow's cutover unit may be marked migrated.