SEC-1372: Return an empty list rather than null from SessionRegistryImpl.getAllSessions()

If the principal has no sessions, null is returned which contradicts the interface contract. In practice it didn't matter as the null was checked for, but it is cleaner to disallow a null value.

core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java

@@ -62,7 +62,7 @@ public class SessionRegistryImpl implements SessionRegistry, ApplicationListener
         final Set<String> sessionsUsedByPrincipal = principals.get(principal);
 
         if (sessionsUsedByPrincipal == null) {
-            return null;
+            return Collections.emptyList();
         }
 
         List<SessionInformation> list = new ArrayList<SessionInformation>(sessionsUsedByPrincipal.size());