Use APPLICATION_SCOPE for the session lock (#11804)

Use APPLICATION_SCOPE for the session lock (#11804)

* Use APPLICATION_SCOPE for the session lock

To be able to do this, relevant methods in VaadinService are made protected so
that VaadinPortletService can override them.

The Vaadin session itself is also stored in APPLICATION_SCOPE. The default
scope is PORTLET_SCOPE, so lock would otherwise not be in sync with
the session.