PreDestroy method (still) not invoked on javax.faces.bean.ViewScoped beans on Session invalidation

It seems to me that the issue reported in https://issues.apache.org/jira/browse/MYFACES-4047 wasn't fixed completely.  I'm currently looking at a scenario with a basic javax.faces.bean.ViewScoped bean and a short session timeout: @PostConstruct is invoked as expected, however @PreDestroy is not invoked when the backing session is invalidated via a timeout.  @PreDestroy is invoked correctly in the normal non-timeout cases, and it's also invoked on session timeout for CDI javax.faces.view.ViewScoped beans.

This gets into how ManagedBeanDestroyer.sessionDestroyed() is implemented:

https://github.com/apache/myfaces/blob/2.2.x/impl/src/main/java/org/apache/myfaces/webapp/ManagedBeanDestroyerListener.java#L121

if we don't have an active FacesContext when we get the sessionDestroyed() event, then we create a new StartupServletExternalContextImpl and pass that to the current ViewScopeProvider.  That's a problem: the non-CDI ViewScopeProvider needs to be able to get at the session from the external context, and StartupServletExternalContextImpl is implemented such that it always returns null for getSession() and getSessionMap().  So in this case the non-CDI DefaultViewScopeProvider will never clean up or call PreDestroy on the ViewScoped beans.

My idea for a fix is to allow an HtppSession to be set on the StartupServletExternalContextImpl.  I'll attach a PR shortly.