[SDK-3808] Optionally sign the session store cookie

[adamjmcgrath]

Description

Add an option signSessionStoreCookie (default false) - when true and using a custom session store, the session store cookie will be signed. e.g.

// session store => {"123abc": { ... session ... } }

// before
Cookie: appSession=abc123

// after (with cryptographically secure signature)
Cookie: appSession=abc123.b1825178d1f21747e60d329c2cfc21a9c

The default session id is a cryptographically secure random value, but this is useful when you want to override genid and you are only generating a unique value, not a cryptographically secure random value.

Also adding a requireSignedSessionStoreCookie config option to allow zero down time migration to signed session store cookies.

fafa0e0 The first commit is just moving some code into another file to make it easier to share
d1c3dc0 This is the main commit that implements signed session store cookies

References

express-session docs
genid

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[Widcket]

Any way to not duplicate these values that are already used in the header constant?

[adamjmcgrath]

👍 have moved these into constants

Also, noticed a typo - thanks