Remove Pause dependency by inlining stream buffering logic.

[trustinpeace]

The pause package (0.0.1) is passport's only remaining production dependency that exists solely to support the optional pauseStream path
in SessionStrategy. The package was published in 2010, has not been updated since 2015, and has been effectively abandoned for a decade.
It is flagged as an operational risk in dependency audits that scan for stale packages.

pause is a small, self-contained utility — 30 lines — that buffers data and end events on a stream and replays them on demand. This patch inlines that logic directly into lib/strategies/session.js as a private pauseStream function, removing the external dependency entirely.
The public API and runtime behavior of the pauseStream option are unchanged.

What changed:

• lib/strategies/session.js — replaced require('pause') with an equivalent inline pauseStream function; the call site (pause(req) →
  pauseStream(req)) is the only other change
• package.json — removed "pause": "0.0.1" from dependencies
• test/strategies/session.pause.test.js — updated from a proxyquire-based spy approach (which depended on the module boundary that no
  longer exists) to direct behavioral tests using EventEmitter; added a test that verifies stream events buffered during async
  deserialization are correctly replayed to later-registered listeners
• test/integration/session-pausestream.test.js — new end-to-end tests using Express + express-session + supertest covering:
  unauthenticated requests, login/session establishment, session restoration with and without pauseStream, and body data replay to
  on('data') listeners placed after passport middleware

Known limitation (pre-existing, not introduced by this patch): pipe-based body parsers such as express.urlencoded read from the stream's
internal buffer rather than EventEmitter events, so they are unaffected by pauseStream. This was equally true of pause@0.0.1.

Checklist

• I have read the CONTRIBUTING guidelines.
• I have added test cases which verify the correct operation of this feature or patch.
• I have added documentation pertaining to this feature or patch.
• The automated test suite ($ make test) executes successfully.
• The automated code linting ($ make lint) executes successfully. (13 jshint failures in sessionmanager.js, authenticationerror.js, and
  http/request.js are pre-existing and unrelated to this change. lib/strategies/session.js — the only file modified by this patch lints cleanly.)