Avoid sending the raw PHP session ID to LangFuse

Problem/Motivation

The module sends the raw PHP session identifier to LangFuse as the trace
sessionId. It is set in
LangFuseTraceManager::resolveTraceIdentity() (used by
ensureTrace()).

session_id() returns the live session token, the same
secret stored in the user's session cookie. Forwarding it to a third-party
observability backend (especially LangFuse Cloud) leaks a credential: anyone
who can read traces could replay that value to hijack the user's session.

Proposed resolution

Hash the session ID before it leaves Drupal, so traces still group requests
from the same session but the value can no longer be replayed as a token.

Remaining tasks

• Review / RTBC.

API changes

None. Method signatures are unchanged.

Data model changes

None.