fix: make NewSession behave same way like UpdateSession method

[xmlking]

Before submitting this PR:

Noticed session creation behave is different when UpdateSession method is called vs NewSession method is called.
keeping the behavior same for both methods, producing similar allowedRoles in session.

Checklist

• No breaking changes
• Tests pass
• New features have new tests
• Documentation is updated

Breaking changes

Avoid breaking changes and regressions. If you feel it is unavoidable, make it explicit in your PR comment so we can review it and see how to handle it.

Tests

• please make sure your changes pass the current tests (Use the make test or the make watch command).
• if you are introducing a new feature, please write as much tests as possible.

Documentation

Please make sure the documentation is updated accordingly, in particular:

• Workflows. Workflows are Mermaid sequence diagrams
• Schema. The schema in a Mermaid ER diagram
• Environment variables. Please adjust the .env.example file accordingly
• OpenApi specifications. We are using inline JSDoc annotations

[xmlking]

the patch is verified with this testing project
https://github.com/xmlking/nhost-multi-tenancy-experiment

[dbarrosop]

LGTM we need to make the linter happy though, I'd suggest just disabling the funlen check like in the UpdateSession method so just add //nolint:funlen after NewSession (

Also, rebase so you get the CI fix from here: #596