feat(cookies): Use the same-site attribute to lax (mastodon#8626)

CSFR-prevention is already implemented but adding this doesn't hurt.

A brief introduction to Same-Site cookies (and the difference between strict and
lax) can be found at
https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/

TLDR: We use lax since we want the cookies to be sent when the user navigates
safely from an external site.

config/initializers/devise.rb

@@ -10,6 +10,7 @@
  expires: 1.year.from_now,
  httponly: true,
  secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
+ same_site: :lax,
  }
 end
 
@@ -20,6 +21,7 @@
  expires: 1.year.from_now,
  httponly: true,
  secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
+ same_site: :lax,
  }
  else
  warden.logout

config/initializers/session_store.rb

@@ -1,3 +1,3 @@
 # Be sure to restart your server when you modify this file.
 
-Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true')
+Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'), same_site: :lax

spec/rails_helper.rb

@@ -29,6 +29,7 @@ def sign_in(resource, _deprecated = nil, scope: nil)
  value: resource.activate_session(warden.request),
  expires: 1.year.from_now,
  httponly: true,
+ same_site: :lax,
  }
  end
 end