Improve handling of VaadinSession to minimize memory usage

[AB-xdev]

Describe your motivation

We are currently running a application that is mostly used by mobile devices. The app has a rather large session lifetime (a bit more than 1h) due to authentication and caching purposes.

During peak load we noticed that the app requires a ton of memory - caused by contents inside the VaadinSession that might not actually needed anymore:

1. Vaadin UIs (inside the session) are only closed when requests happen. The problem with e.g. mobile devices is that they might stop sending request after some time - due to lost network connectivity or because the task manager suspended the browser to preserve battery. MDN has another good example. This causes inactive UIs to never be closed after the heartbeatTimeout (hearbeatInterval[default=5min] * 3.1) is reached and basically "hang" forever inside the session - with the entire UI state.
2. UIInternals#lastRequestResponse contains the last response for a request during the entire lifetime of the session. During heapdump analysis I found sessions that consumed 2x the memory because of this:
   

Describe the solution you'd like

Regarding the problems:

1. Keep checking the sessions in the background and cleanup any inactive UIs
   • It would be nice if heartbeatTimeout could be configured by the user like is the case for hearbeatInterval
2. UIInternals#lastRequestResponse: Delete this after a certain time without any real requests.

Describe alternatives you've considered

For now we worked around the problems by running a scheduled background thread that cleans up the sessions.
The corresponding code was ported to/is available at our SSE framework.

Here is the memory usage without the cleaner:

and here when it's enabled:

[Legioth]

The challenge with more eager cleanup is that we'd have to run a timer thread for doing that cleanup and that's a challenging thing to do in a servlet environment since the "correct" way of doing that is different between Spring Boot, Jakarta EE, and vanilla servlet environments. But nowadays with Vaadin versions that require Java 21 or newer, we could also cheat a bit and run that timer as a simple virtual thread which doesn't come with the same tradeoffs.

Clearing lastRequestResponse after a timeout for inactive UIs would also require a timer so that's also something we could consider only if we introduce our own virtual thread timer.