Take a look at some of the prior art:

• HTTP-Session
• Catalyst-Plugin-Session-State-URI
• Apache::AuthCookieURL

Also, consider the classic trick of putting the session ID first in the path and using relative URLs:

Your question is a little vague. Do you mean adding it to every tag? Like <i sessionid="asdf"/>? Because that would be invalid HTML. Or add it to the arguments in src like attributes, like <form action="...?sid=asdf"/> and <a href="...?sid=asdf"/>?

Either way the solution is almost certainly based off a parser like HTML::TokeParser. HTML is better handled (accuracy and speed) by parsers for anything robust. If you provide more info or show what you've tried, you'll probably get a decent snippet or two here.

I suspect the most pragmatic approach here might be to change your session-management to use cookies.

Outputting a cookie with session ID in it has got way way less overhead than having to output each file with changed contents.

Failing that you might want to look to see if there is an Apache module that would let you do what you want. There are certainly output filters which can modify the output the server sends after generation - and that would be a good hook to use.