Set Secure Attribute on Session Cookie

[stanenbaum-va]

WASA scans reveal a low security finding when Kiali is served over HTTPS due to the kiali-token-aes only having HTTPOnly, without the Secure attribute.

[jshaughn]

See #6907 for more on what is being requested here.

[jmazzitelli]

Here's the three locations where this enhancement will probably need to touch:

• https://github.com/kiali/kiali/blob/v1.77.0/business/authentication/session_persistor.go#L135-L141
• https://github.com/kiali/kiali/blob/v1.77.0/business/authentication/openid_auth_controller.go#L372-L378
• https://github.com/kiali/kiali/blob/v1.77.0/business/authentication/openid_auth_controller.go#L491-L497

[jmazzitelli]

And here is a brief overview of why this is being asked. https://resources.infosecinstitute.com/topics/general-security/securing-cookies-httponly-secure-flags

Note: Because Kiali's endpoint can be configured to use http only (as opposed to https) we'll want to be able to have the cookie sent over http. Thus the Secure flag should be set on the cookie only if Kiali's endpoint is specifically configured for https; it should not be set when Kiali's endpoint is configured for http.

[jmazzitelli]

This has been implemented - #6930 - that PR is just waiting on review; if that happens in the next day or two, this might get into the upcoming release.