Add opt-out for cookie and session persistence in Language::setLang

[kloostermanw]

Summary

Language::setLang() gains an optional second argument,
$blnPersist (default true). Passing false loads the language
file in-process only, without writing the language cookie or
$_SESSION['language'].

Motivation and Context

REST APIs resolve language statelessly from the Accept-Language
header, but setLang() unconditionally wrote a 30-day cookie and a
session value. That cookie then replayed on every subsequent request
from the same client, so a single endpoint's ?language= choice
leaked across the whole API. The Celery web API needs a way to load a
language in-process without any cookie or session side effects.

The default true preserves today's behavior for every existing
caller; only callers that pass false opt into the stateless path.
The cookie write is extracted into a protected writeCookie() method
so stateless callers can bypass it (and so it is observable in tests,
since the CLI SAPI sends no real headers).

closes #29

How Has This Been Tested

• Five new unit tests in LanguageTest cover the three acceptance
  cases: no-persist writes neither cookie nor session but still loads
  the language file; the default still writes both.
• Full suite green: 251 tests, 854 assertions.
• phpstan analyse (level 6, classes/) reports no errors.

Types of Changes

• New feature (non-breaking change which adds functionality)

Checklist

• My code follows the code style of this project.
• I have added tests to cover my changes.
• All new and existing tests passed.