Refactored Session usage with cookies

[xecdev]

This PR fixes #52 by refactoring the code to use cookies instead of sessions. We replaced all session_start()-based state tracking with signed, HTTP-only cookies. Sessions turned every request into a “do-not-cache” hit, which broke performance on hosts that sit behind full-page caches (NGINX, Varnish, CDNs) and triggered a warning from the WP Plugin Review Team. Moving to cookies restores full cacheability while keeping user data on the client, and the scheme remains secure because each cookie value is protected with an HMAC derived from wp_salt('auth') and bound to a lightweight device fingerprint.

The new PayButton_State helper now stores the user’s wallet address and unlocked-content list in two cookies that expire after seven days. Cookies are set only when their value changes (reducing cache-bypass headers), are flagged Secure, HttpOnly, and SameSite=Lax, and are validated on every read. All previous $_SESSION references and session headers were removed, so sites gain immediate compatibility with managed-WordPress caching layers without altering existing paywall functionality.

Test plan:

• Remove the old version of the plugin
• Install and activate this new version of the plugin (make sure your test site has SSL)
• Test paywall and logging via Cashtab functionality thoroughly and make sure it works as intended