fix(mqtt): scope session state per instance and guard a missing client id - #8092

What this changes

SessionRepository was the only repository in shenyu-protocol-mqtt that kept its state in a
static map. It is now a per-instance map, like ChannelRepository, InflightRepository,
SubscribeRepository and WillRepository already are.

Subscribe and Unsubscribe looked the session up with the client id read from
ChannelRepository:

String clientId = Singleton.INST.get(ChannelRepository.class).get(ctx.channel());
MqttSession session = Singleton.INST.get(SessionRepository.class).get(clientId);

ChannelRepository.get(channel) returns null for a channel that CONNECT never registered, or
whose client id ownership was taken over by a newer connection (#7918). The session index is a
ConcurrentHashMap keyed by client id, and a null key throws:

java.lang.NullPointerException: Cannot invoke "Object.hashCode()" because "key" is null

so the whole SUBSCRIBE / UNSUBSCRIBE aborted before the SUBACK / UNSUBACK was written.
Publish.registerInbound and PubRel.pubRel already guard this case; the two handlers now do the
same and simply skip the session bookkeeping.

Why the tests passed before

Because the map was static, Singleton.INST.single(SessionRepository.class, new SessionRepository())
did not create fresh state: every instance shared one map, so a test could see sessions registered by
a test class that ran earlier in the same JVM. That masked both the missing fixtures and the null-key
NPE. MqttTransportHandlerTest shows the pattern clearly — run on its own, before this change, it
fails with Singleton.get(InflightRepository.class) returning null; it only passed as part of the
whole module because an earlier test class had left that registration behind.

Tests

Reverting only the three main-code files makes all four new assertions fail with the exact
production error (Cannot invoke "Object.hashCode()" because "key" is null), which is the
regression this PR removes.

mvn -pl shenyu-protocol/shenyu-protocol-mqtt test
Tests run: 150, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

checkstyle:check on the module is clean.

Notes

• No behaviour change on the happy path: a connected client always has a client id in
  ChannelRepository, so the session is still updated on SUBSCRIBE / UNSUBSCRIBE.
• #8089 also targets the MQTT fixture isolation but does not compile (variable channelRepository is already defined in class); this PR supersedes it.