Consider http_external_uri when setting the cookie path

[thll]

Changes which path is chosen to populate the Path attribute in the authentication cookie.

Previously, the path was chosen as follows, highest priority first:

1. The path from the URL in the X-Graylog-Server-URL request header
2. The path from the Origin request header
3. /

With this PR, the value will be chosen as follows:

1. The path from the URL in the X-Graylog-Server-URL request header
2. The path from the http_external_uri configuration setting
3. /

The Origin header does not contain a path. See here:

The Origin header is similar to the Referer header, but does not disclose the path, and may be null.

It was therefore removed as a potential source for the Path attribute.

The http_external_url does however provide a relevant value for restricting the cookie path. It will therefore now be considered.

Furthermore, to prevent the injection of cookie values via the X-Graylog-Server-URL header, all characters that are not valid for the Path attribute are now stripped.

[dennisoelkers]

Code looks good, tests look fine! Leaving extensive testing to @kroepke.

[kroepke]

ltgm