Add SameSite support

[joshcanhelp]

Description

When merged, this PR will add SameSite cookie support for required authentication values. Both the nonce (checked against the value in the ID token during callback) and state (checked against the value returned from the authorization server during callback) values will move from session storage to cookie storage. This allows a SameSite attribute of None to be added, as well as a Secure flag, when the response_type of form_post is used (this is the default configuration).

By default, a legacy support cookie with no SameSite attribute and no Secure flag will be set as well (this can be turned off with the legacySameSiteCookie attribute passed to the auth() configuration). This is done to support browsers that do not handle SameSite cookies set to None but has the added benefit of allowing insecure local applications to function without SSL/TLS in the interim.

Please note: The browser changes unexplained in the Web.dev article below will require all applications (including local ones) using the response_mode of form_post (default for this library) to be served over HTTPS.

Changes to follow

There are a few more changes that need to happen in this library to fully support SameSite. These will come in [a] separate PR[s]:

• This library should not require session management to be setup by developers. Instead, we will use our own internal session, which will be cookies by default but configurable. This authentication session will use SameSite=Lax and will not provide a public API to change/add.
• We will continue using separate cookies for the transient state and nonce values (as introduced here).
• We need to add support for max_age (have an internal task tracking that).

References

Web.dev: SameSite cookies explained

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• All active GitHub checks for tests, formatting, and security are passing

[stevehobbsdev]

@joshcanhelp Would like to pair with you on this review if that's ok.

[stevehobbsdev]

LGTM! Liking the new changes :)