Fix/901 OIDC cookie http only

[ErvinRacz]

Make session cookie HTTP only

See: #901

Testing done

Run the stack locally with oidc auth mode:

air --build.cmd "go build -o ./bin/nebraska ./cmd/nebraska/main.go" \
         --build.bin "./bin/nebraska" \
         --build.args_bin "\
     -debug \
     --auth-mode oidc \
     --oidc-admin-roles nebraska_admin \
     --oidc-viewer-roles nebraska_member \
     --oidc-roles-path \"http://kinvolk\.io/roles\" \
     --oidc-client-id [redacted]\
     --oidc-issuer-url https://[redacted].com/ \
     --oidc-client-secret [redacted] \
     -oidc-valid-redirect-urls http://localhost:3000/*"

Obeserve that the oidc cookie has the httponly flag after login:

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.