OIDCClientConfiguration#getOIDCSession should not fail if ServletSession#getHttpSession returns null

It seems that in some setups/version the actual HTTP session can be null. It's very unexpected and there is XWIKI-23990 for it. But in the meantime it would be nice to add ad much bulletproofing as possible.