Replace use of MD5 in session.py

[akurtz-penguin]

session.hashed_value uses hashlib.md5

While this MD5 usage isn't security related, MD5 usage is deprecated. It triggers security warnings for scanners, and isn't available in FIPS environment.

The easiest solution would be to use a different algorithm, such as SHA256 or SHA512.

[jvanasco]

I'm open to PRs that would allow this to be configurable by end-users, but I don't foresee myself supporting this anytime soon. That would address your concern with support for people using FIPs libraries.

This package does a lot to eke out as much performance and as small a footprint as possible. Potentially, only a substring of a larger digest could be used, but I still have reservations. Right now, dropping MD5 is off the table.

Quickly looking at the code for a refresher:

• :class:_SessionState needs to access a fingerprint
• _SessionState is only invoked by RedisSession
• :class:RedisSession needs to access a fingerprint
• RedisSession accepts multiple callables,

What I'm comfortable with right now:

• any code named "hash" could be renamed "fingerprint" or even "insecure_fingerprint" , so a manual audit will pass easier.
• RedisSession could accept/register a fingerprint_func callable (or similar name), then use that and pass it to _SessionState
• RedisSessionFactory would accept the same arg, and pass it to RedisSession