Invalidate split_cookies client-side

[carlobeltrame]

Like in #809, we use the split_cookie extractor to store the JWT token in two separate cookies, one of which is available in the JS frontend and one of which is not.
Also I read in #847 (comment) that on logout, JWT tokens should just be deleted client-side.

Now our frontend JS code can only delete the jwt_hp cookie, but not the jwt_s cookie, because that one is marked httponly. I see a few options how we could solve this:

• Ideally, the split_cookie extractor should be changed to require all the cookie parts. Currently it happily continues when some of the cookie parts are missing, but then joins all cookie values (whether present or not) with periods. This doesn't really make sense in any conceivable case: e.g. jwt_hp=eyABCD.ey12341234 and a missing jwt_s cookie will result in the token eyABCD.ey12341234., which can never be a valid JWT token because of the period in the end. For this reason, this wouldn't be a breaking change either, because no developers could have successfully used partial split cookies so far.
  I'd be happy to prepare a pull request to fix this if you're open to this change.
• Otherwise, I could listen to the JWT_INVALID event and delete all of my split cookies (by overwriting them with an expired expiry date).
• Or I could listen to some early Symfony event and delete all of my split cookies if not all of them are present.

I have found no easy way to extend / override the existing SplitCookieExtractor, otherwise that would be an option as well.