fix: clear all session entries in SessionStore::purge() regardless of key order

[kishore7snehil]

Changes

SessionStore::purge() walked $_SESSION with while ($sessionKey = key($session)) and advanced with next(). That loop condition is also falsy when a session key is 0 or "", so if such a key appeared before the SDK's own prefixed entries, iteration stopped early and left the remaining auth0_* entries in the session. Because Auth0::logout() clears state through purge(), the leftover entries could persist after logout when the surrounding application had written a falsy-keyed value to $_SESSION.

🐛 Bug Fix:

• SessionStore::purge() now iterates a snapshot of the session keys via array_keys() instead of the key()/next() cursor, so a falsy key can no longer terminate the loop early and every prefixed entry is removed
• The prefix check uses str_starts_with() guarded by is_string(). On v9 the previous loop already cast the key with mb_substr((string) $sessionKey, ...), so the is_string() guard here is hardening. The uncast mb_substr() path only exists on 8.x, where dropping it is a genuine TypeError fix, so the 8.x backport is where that matters
• purge() stays read-only and no longer touches $_SESSION when it is unset, matching the prior behavior

References

N/A

Testing

• Added purge() clears values when a falsy key precedes them in the session, which seeds an empty-string and an integer 0 key before the prefixed entry and asserts the prefixed entry is removed while the non-Auth0 entries survive

• Added purge() clears values when a falsy integer key precedes them in the session, covering the php_serialize leading-integer-key case with no empty-string key present

• Reset $_SESSION in beforeEach so the seeded falsy keys do not leak into other tests under randomized ordering

• This change adds unit test coverage

• This change has been tested on the latest version of the platform/language

Contributor Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 code of conduct