Improvements on browser SSO - #3907

Purpose

Follow-up to #3779 (flow-centric browser SSO), addressing review comments raised after merge. Pure code-organization and internal-cleanup changes in the flow session subsystem — no behavioral or API changes.

Approach

• Single store implementation — now that the SSO session, session-context, and participant stores share one store type behind a single package-private sessionStore interface, their split source files (session_context_store.go, participant_store.go) are merged into store.go. All methods already had the *store receiver, so this is a pure file consolidation.
• Uniform query IDs — the SQL query constants are renumbered under one SSO-SESS-NN prefix (01–11), dropping the old -AC-/-PART- sub-prefixes that reflected the previously-separate stores. IDs are internal identifiers only (no DB/functional impact).
• No JSON test fixture — TestSSOFlowDefinitionBuilds now constructs the flow definition inline as a Go literal (matching the dominant pattern in graph_builder_test.go), and testdata/sso_flow.json is removed. The test still runs against the real executor registry, so a typo'd executor name or dangling node reference still fails it.
• Reuse the fetched flow version — the active flow version is now captured from the flow already fetched at context load (initContext / loadContextFromStore) instead of re-fetching it in a dedicated resolveActiveFlowVersion call. That method and the now-redundant flowUsesSSOSession gate are removed; the version is carried on EngineContext.SSOFlowVersion the same way the inbound handle already is.

Related Issues

• Basic SSO: reuse an existing login session across applications #3672

Related PRs

• Follow-up to Add flow-centric browser SSO #3779

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Bug Fixes

  • Improved SSO session compatibility checks by consistently associating sessions with the active flow version.
  • Improved handling of inbound SSO sessions during flow execution.

• New Features

  • Session context and participant information can now be saved, retrieved, listed, and removed per session checkpoint.
  • Added safeguards against storing session contexts that exceed the supported size limit.