HTTP Sessions are never expired in Avatica server

Http Sessions created by the Avatica server are never expired.
This eventually causes the Avatica server to OOM.

Well designed clients using long-lived sessions may never generate enough sessions between server restarts for this to become apparent, but ill-behaved clients creating a lot of sessions can fill the heap in a short time.

As the Jetty default (when not using the web.xml descriptor) is infinite lifetime, we need to set a reasonable default idle timeout when setting up Jetty Session handling.