Set SameSite Strict only on OIDC session cookie

[sberyozkin]

Fixes #30625.

OIDC session cookie (represents the current user authentication) but also state cookie (which is used to coordinate the code flow with Keycloak where a returned state query parameter is matched against it) and the logout cookie (helper cookie for the Quarkus app to verify the post logout is correct) were all set to have SameSite=Strict attribute as part of the hardening effort for various cookies.

Unfortunately it has caused the immediate side-effects when using the browser with providers incl Keycloak (see #30625, I confirmed it) which can only be fixed by configuring that SameSite=Lax is used.

I missed it as HtmlUnit was not enforcing the SameStrict policy correctly for the cross-site redirects and DevServices for Keycloak is not affected as it has its own SPA.

It has to be reverted at least on main/2.16 branches. Looks like some providers are not affected (ex GitHub) but in general, expecting users having to configure samesite=lax to fix the problem is not a good evolution of quarkus-oidc.
FYI, the session cookie will remain samesite=strict but also can be configured to be samesite=lax.

Updated the tests to verify it is now the case: 1) no SameSite attribute for state/logout cookies - which means it is the Lax default value 2) session cookie is same site strict by default, lax if requested in the config.

[quarkus-bot]

✔️ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[sberyozkin]

Thanks @gastaldi, I've asked @pmlopes to comment as well but in any case I think this PR is is the right one, Paulo, we can tweak things if necessary, FYI, OIDC session cookie is samesite strict