Fixes #2157, Explicitly set SameSite value for cookies

[tankerkiller125]

Also contains an update for the cookie library dependency

**Fixes #2157 **

Changes proposed in this pull request:

Updates the cookie library and explicitly sets the same site value

Reviewers should focus on:

• Is Lax the value we want to set? None requires HTTPs and Strict would prevent cookie use on a primary/sub-domain

Confirmed

- [ ] Frontend changes: tested on a local Flarum installation.

• Backend changes: tests are green (run composer test).

[askvortsov1]

As per https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite, Lax seems to be the default value, so I think lax is best for now (this way we just avoid browsers complaining about no explicit setting).

We can consider hardening this, as well as the stuff in #353 and https://discuss.flarum.org/d/22642-security-roadmap, later on. For now, 👍

[askvortsov1]

Only one thought: is there any place where we could add a unit test to confirm that the cookie returns samesite=lax as expected?

[rob006]

Wouldn't that break some use-cases for https://github.com/flarum/embed?

[askvortsov1]

I'd still like to see a unit test for this, but otherwise looks great!

[tankerkiller125]

@askvortsov1 Any suggestions as to where in the testing this would fit? Not sure if we would classify it as a unit test or integration test.

[askvortsov1]

It seems from the cookie library code that the actual cookies are resolved by calling toString on them ( (string) $cookie)), so perhaps in a unit test, we could assert that the proper samesite value is present in the resolved cookie string? I wouldn't mind an integration test as well, but I'd hold off on that until we have more of other stuff we can test.

[tankerkiller125]

Got an error with the example, code from luceos. Actually found an even nicer way of doing it I think but I need to get my unit test working properly first on my laptop. If it does work it will be SameSite::{$this->samesite ?? 'lax'}() which I think is much easier to understand and looks better. (Supported syntax in 7.0 and up)