Add compatibility cookie for SameSite, with option to turn it off

[stevehobbsdev]

Changes

#1229 introduced a change that set sameSite to none when using HTTPS. This can cause problems for older user agents that don't support this. This PR introduces a compatibility cookie where secure is set and sameSite is left blank, much like Auth0 Server behaviour as well as in Auth0 SPA SDK.

See https://www.chromium.org/updates/same-site/incompatible-clients for information on which browsers are affected.

In addition, a new configuration option legacySameSiteCookie is introduced to control this behaviour. It defaults to true when not configured, which enables the legacy SameSite cookie behaviour. Setting legacySameSiteCookie to false disables this behaviour.

References

#1229

Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

• This change adds unit test coverage
• This change adds integration test coverage

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All tests and linters described in the Develop section run without errors

[stevehobbsdev]

Note for reviewers: looks like the diff has a lot of formatting changes in, I can recommend turning off whitespace changes to dilute it a bit.