Allow Session change without session token

[livio-a]

The session update and deletion require the current session token as argument.
Since this adds extra complexity but no real additional security and prevents case like magic links, we want to remove this requirement.

We still require the session token on other resouces / endpoints, e.g. for finalizing the auth request or on idp intents.

Acceptance criteria

• Deprecate the token field on update and delete endpoint
• Update all documentation examples without token use

[livio-a]

relates to #6099

[muhlemmer]

@livio-a, I have 2 questions:

1. If we remove the token from the delete endpoint, it is a breaking change. Do we really want this? The token was already optional.

zitadel/docs/docs/guides/integrate/login-ui/_logout.mdx

Lines 4 to 7 in 6cf9ca9

	Sessions can be terminated by either:
	- the authenticated user
	- a manager, who is granted `session.delete` (e.g. ORG_OWNER) on the authenticated users organisation
	- providing the current session_token in the body.

As without the token we can't establish the "authenticated user" and the logic falls back to the session.delete permission. I kind of figured because the OIDC integration tests break, as the CTXLOGIN user does not have the permission through the ORG_USER_MANAGER role for example.

I have a draft PR here if you want to check what I mean: #7963

2. Did we also say we no longer want to update the session token on write? I'm not sure anymore.

[livio-a]

@livio-a, I have 2 questions:

1. If we remove the token from the delete endpoint, it is a breaking change. Do we really want this? The token was already optional.

zitadel/docs/docs/guides/integrate/login-ui/_logout.mdx

Lines 4 to 7 in 6cf9ca9

	Sessions can be terminated by either:
	- the authenticated user
	- a manager, who is granted `session.delete` (e.g. ORG_OWNER) on the authenticated users organisation
	- providing the current session_token in the body.

As without the token we can't establish the "authenticated user" and the logic falls back to the session.delete permission. I kind of figured because the OIDC integration tests break, as the CTXLOGIN user does not have the permission through the ORG_USER_MANAGER role for example.

I have a draft PR here if you want to check what I mean: #7963

2. Did we also say we no longer want to update the session token on write? I'm not sure anymore.

1. I would keep the token there as is (optional) and only change the update request.
2. Always update and return the session token.

[github-actions]

🎉 This issue has been resolved in version 2.53.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀