fix(core): Guard clearSession with session lock to prevent NPE (#5657)

* fix(core): Guard clearSession with session lock to prevent NPE

clearSession() reset the session field without acquiring sessionLock,
unlike the other session mutators (startSession, endSession,
withSession). This allowed it to null out the session between a
null-check and a dereference (e.g. session.clone()) in those locked
methods, leading to a NullPointerException. Acquire sessionLock so all
session mutations are mutually exclusive.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* changelog

* changelog

* changelog

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: markushi

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+### Fixes
+
+- Fix potential NPE within `Scope.endSession()` ([#5657](https://github.com/getsentry/sentry-java/pull/5657))
+
 ### Performance
 
 - Speed up touch gesture target detection on deeply nested view hierarchies by hit-testing in local coordinates instead of calling `getLocationOnScreen` per view ([#5595](https://github.com/getsentry/sentry-java/pull/5595))

sentry/src/main/java/io/sentry/Scope.java

@@ -1147,7 +1147,9 @@ public SentryOptions getOptions() {
   @ApiStatus.Internal
   @Override
   public void clearSession() {
-    session = null;
+    try (final @NotNull ISentryLifecycleToken ignored = sessionLock.acquire()) {
+      session = null;
+    }
   }
 
   @ApiStatus.Internal