Find client-supplied session identifiers

Finds calls to HttpServletRequest.getRequestedSessionId() (javax and jakarta, including implementations such as HttpServletRequestWrapper). The identifier comes from a client cookie or URL parameter, so it may be spoofed and should only be trusted by the servlet container. Search only: the obvious replacement, getSession().getId(), creates a session, and where the ID is logged it would leak a live session token.