[26.0] Cancel background traffic before login/register so session cookie isnt clobbered

[mvdbeek]

When handle_user_login invalidates the previous anonymous session and a concurrent request using the old cookie is still in flight, the server creates a new anonymous session for it and responds with a fresh Set-Cookie: galaxysession=<anon>. If that response lands between the login POST and the full-page navigation, the browser navigates with the anonymous cookie and the new page loads logged out.

Fix: synchronously stop the polling watchers and rotate a shared AbortController before sending the login/register POST. The shared signal is wired through both axios (via a request interceptor) and the GalaxyApi/openapi-fetch client (via a request middleware) so a single rotation cancels every in-flight request, regardless of transport. With no in-flight anonymous-cookie request, the server can't emit the clobbering Set-Cookie, and the authenticated cookie survives until navigation.

Backport of the relevant pieces of #22513 (sse-notifications) for release_26.0 — the same race exists outside SSE because it is the in-flight polling/REST traffic, not the SSE stream itself, that carries the stale cookie.

Should also stabilize occasional unspecific selenium failures that fail around login.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.