Use getApplicationMetadata() for cross-platform session detection in TokenService

[Copilot]

Addresses review feedback on #238: structKeyExists(variables, "session") doesn't reliably detect if session management is enabled across CFML engines.

Changes

• Cross-platform session detection: Use getApplicationMetadata().sessionManagement instead of structKeyExists() - works on Lucee 5+, ACF 2021+, ACF 2023+, BoxLang 1+
• Lazy metadata caching: Store application metadata in variables.appMetadata to avoid repeated lookups
• Graceful degradation: Wrap session.sessionid access in try-catch to handle startup edge cases where session scope exists but sessionid isn't yet available

Implementation

private function isSessionManagementEnabled() {
    if ( structIsEmpty( variables.appMetadata ) ) {
        variables.appMetadata = getApplicationMetadata();
    }
    return structKeyExists( variables.appMetadata, "sessionManagement" ) 
        && variables.appMetadata.sessionManagement;
}

private function generateNewToken() {
    var tokenBase = "#createUUID()##getRealIP()##randRange(0, 65535, "SHA1PRNG")##getTickCount()#";
    var sessionId = "";
    
    if ( isSessionManagementEnabled() ) {
        try {
            sessionId = session.sessionid;
        } catch ( any e ) {
            // Continue without sessionid if not available
        }
    }
    
    return uCase( left( hash( tokenBase & sessionId, "SHA-256" ), 40 ) );
}

Enables TokenService to work with both SessionCSRFStorage (requires sessions) and CacheCSRFStorage (session-independent).

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.