Handling of expired sessions bugged

[solth]

Describe the bug
The changes of #6047 have broken the handling of expired http sessions. This seems to stem from the sessionDestroyed method being moved from KitodoVersionListener to SessionService. The later is not annotated as WebListener (as KitodoVersionListener is). Adding the annotation alone does not resolve the issue, but moving the sessionDestroyed method back to KitodoVersionListener does, so we probably need a dedicated HttpSessionListener extension to handle expiring sessions, instead of (mis-)using the service class SessionService or the KitodoVersionListener for this purpose.

To Reproduce
Steps to reproduce the behavior:

1. Log into Kitodo with one user account in one browser (for example Chrome)
2. Close the browser (without logging out of Kitodo)
3. Log into Kitodo with a different user account in a different browser (for example Firefox)
4. After http session expires (check web.xml for session timeout value) check the user list in the second browser
5. See error that first user - whose http session is expired - is still displayed as logged into the system on the user page - which also results in his metadata locked processes not being released!

Expected behavior
User sessions should expire on http session timeout even if the user does not have an open Kitodo window in the browser.

Release
3.8, current main branch