Decouple SessionMetadata and TransportCredentials

TransportCredentials are per-request, not per-session, and
there's no reason to carry them within SessionMetadata.

While I'm in here, get rid of "null" credentials.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=125202213

java/google/registry/tools/ValidateLoginCredentialsCommand.java

@@ -104,12 +104,11 @@ final class ValidateLoginCredentialsCommand implements RemoteApiCommand, GtechCo
             LoginFlow.class,
             unmarshal(EppInput.class, inputXmlBytes),
             Trid.create(null),
-            new HttpSessionMetadata(
-                new TlsCredentials(
-                    clientCertificateHash,
-                    Optional.of(clientIpAddress),
-                    "placeholder"),  // behave as if we have SNI on, since we're validating a cert
-                new BasicHttpSession()),
+            new HttpSessionMetadata(new BasicHttpSession()),
+            new TlsCredentials(
+                clientCertificateHash,
+                Optional.of(clientIpAddress),
+                "placeholder"),  // behave as if we have SNI on, since we're validating a cert
             inputXmlBytes,
             null,
             new SystemClock()).run()), UTF_8));