[CLI] Set default CSRF protection for sessions in the configuration

[LoicPoullain]

Issues

• Since v4.17.0, ExpressJS has supported the none option for the SameSite cookie attribute. Developers should be able to use this value.
• Developers using cookies (for example with @TokenRequired({ cookie: true })) might not be aware of CSRF attacks and how to protect against them. We should set up a default protection for this in every new project.

Solutions and steps

• Update the CookieOptions interface.
• Configuration generated with the command createapp will include a default CSRF protection for sessions : the cookie attribute SameSite will be set to lax.

Checklist

• Add/update/check docs (code comments and docs/ folder).
• Add/update/check tests.
• Update/check the cli generators.

[codecov]

Codecov Report

Merging #594 into v1-4-0 will increase coverage by 0.4%.
The diff coverage is n/a.

@@            Coverage Diff            @@
##           v1-4-0     #594     +/-   ##
=========================================
+ Coverage   99.16%   99.57%   +0.4%     
=========================================
  Files          65       88     +23     
  Lines        1083     1635    +552     
  Branches      266      373    +107     
=========================================
+ Hits         1074     1628    +554     
+ Misses          9        7      -2

Impacted Files	Coverage Δ
packages/core/src/core/http/http-responses.ts	100% <ø> (ø)	⬆️
...c/openapi/metadata-getters/get-api-request-body.ts	100% <0%> (ø)	⬆️
.../metadata-getters/get-api-operation-description.ts	100% <0%> (ø)	⬆️
packages/core/src/common/utils/controller.util.ts	100% <0%> (ø)	⬆️
...napi/metadata-getters/get-api-operation-summary.ts	100% <0%> (ø)	⬆️
...ages/core/src/common/utils/verify-password.util.ts	100% <0%> (ø)	⬆️
...core/src/common/tokens/verify-signed-token.util.ts	100% <0%> (ø)	⬆️
packages/core/src/sessions/token-optional.hook.ts	100% <0%> (ø)	⬆️
packages/core/src/common/utils/get-ajv-instance.ts	100% <0%> (ø)	⬆️
packages/core/src/common/utils/escape-prop.ts	100% <0%> (ø)	⬆️
... and 52 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2a4d3be...fe0468e. Read the comment docs.