[SDK-2155] Default cookie.secure config to the protocol of baseURL

[adamjmcgrath]

Description

Default the cookie.secure config to the protocol of the baseUrl config - rather than defaulting it to the protocol of the req.url (which relies on the developer to set trust proxy when behind a proxy)

And a couple of other things that should improve the DX around this setting:

• if you override cookie.secure to true and baseUrl is http - throw an error, because this will not work (your secure cookies won't be read over http)
• if you override cookie.secure to false and baseUrl is https - warn the user that the cookie will not be set with the Secure attribute
• If baseUrl is http and response_mode is form_post - warn the use that this will only work for <2min logins (have also added an FAQ for this)

References

Chrome 2 min exception for Lax+POST https://www.chromium.org/updates/same-site
fixes #145

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[panva]

LGTM, i'm leaving some text suggestions.