fix: enforce maxCachedSessions in TLS session cache

[trivikr]

This relates to...

Fixes: #5100

Rationale

SessionCache currently relies on FinalizationRegistry cleanup to remove dead weak references, but it does not evict live entries when the cache reaches capacity. That allows _sessionCache to grow beyond maxCachedSessions for long-lived TLS sessions.

Changes

• Add bounded eviction to SessionCache.set().
• Prefer evicting dead weak-ref entries first when the cache is full.
• Fall back to evicting the oldest live entry when no dead entry is available.
• Refresh insertion order when updating an existing session key.

Features

N/A

Bug Fixes

• Enforce maxCachedSessions even when cached TLS sessions are still alive.
• Prevent the TLS session cache map from growing past the configured limit.

Breaking Changes and Deprecations

N/A

Status

• I have read and agreed to the Developer's Certificate of Origin
• Tested
• Benchmarked (optional)
• Documented
• Review ready
• In review
• Merge ready

Assisted-by: openai:gpt-5.4

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.25000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.13%. Comparing base (67ca48c) to head (7900979).

Files with missing lines	Patch %	Lines
lib/core/connect.js	81.25%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5102      +/-   ##
==========================================
- Coverage   93.13%   93.13%   -0.01%     
==========================================
  Files         110      110              
  Lines       35826    35842      +16     
==========================================
+ Hits        33368    33381      +13     
- Misses       2458     2461       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mcollina]

lgtm