Decouple SessionMetadata and TransportCredentials

TransportCredentials are per-request, not per-session, and
there's no reason to carry them within SessionMetadata.

While I'm in here, get rid of "null" credentials.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=125202213

java/google/registry/flows/HttpSessionMetadata.java

@@ -24,9 +24,8 @@ public class HttpSessionMetadata extends SessionMetadata {
   private final HttpSession session;
   private boolean isValid = true;
 
-  public HttpSessionMetadata(TransportCredentials credentials, HttpSession session) {
+  public HttpSessionMetadata(HttpSession session) {
     this.session = session;
-    setTransportCredentials(credentials);
   }
 
   @Override