Allow SessionStore to return Nothing to skip Set-Cookie

[mpscholten]

When getNewCookie returns Nothing, withSession skips the Set-Cookie header.
This enables session stores to signal "no change" and avoid unnecessary
cookie updates on every response.

Benchmark Results

Tested with a minimal WAI app using withSession+clientsessionStore and a handler that never accesses the session (the common case for most routes):

Scenario	Before	After	Improvement
No cookie (new visitor)	43,858 req/s, p50=2.2ms	128,990 req/s, p50=0.4ms	2.9x throughput, 5.5x lower p50
With cookie (read-only)	39,533 req/s, p50=2.5ms	123,160 req/s, p50=0.4ms	3.1x throughput, 6.3x lower p50

See: #15

[mpscholten]

@singpolyma any thoughts on this?