Add SameSite cookie configuration value for session cookie

[pgroudas]

Values of 'lax' and 'strict' can improve and mitigate
some categories of cross-site traffic tampering.

Given that the nature of this proxy is often to proxy
private tools, this is useful to take advantage of.

See: https://www.owasp.org/index.php/SameSite

Description

This extends the configuration options to add an additional field for COOKIE_SAMESITE
which will be propagated into options used to configure the authentication / session cookie.

If not provided, this will be set to the value of http.SameSiteDefaultMode, which is effectively
the same behavior as before this change.

However, this now allows a user to opt into using SameSiteLaxMode, SameSiteStrictMode,
or SameSiteNoneMode.

Motivation and Context

This change improves security of proxied services by preventing CSRF attacks.

See: See: https://www.owasp.org/index.php/SameSite

How Has This Been Tested?

Unit tests have been updated to verify the additional field on the session cookie.

The SameSite cookie attribute has been verified in debug tools in chrome.

Checklist:

• My change requires a change to the documentation or CHANGELOG.
• I have updated the documentation/CHANGELOG accordingly.
• I have created a feature (non-master) branch for my PR.

[JoelSpeed]

Hey @pgroudas, thanks for raising the PR! Looks good to me in general, very clean code!

I've added one potential improvement as a suggestion below, let me know what you think 😄

[JoelSpeed]

I wonder if the default should be a panic to guard against future changes to the flag checking that might break the functionality?

    ...
    case "":
		return http.SameSiteDefaultMode
    default:
        panic(fmt.Sprintf("Invalid value for SameSite: %s", v))

[pgroudas]

Good idea, done!

[JoelSpeed]

LGTM, thanks @pgroudas!

[idntfy]

@JoelSpeed when do you think it can be expected to be released? the last released version 4.1.0 doesn't have this flag yet, I have to use latest docker build instead of pinned version which is unsafe (not because of changes since we put it to our own repository anyway, but rather because it's a non-released version)

[JoelSpeed]

@idntfy We are planning to release soon, though we need to verify/fix #362 before we can make a release, as soon as that is done the release will happen. Hopefully that will be this week or next

[idntfy]

however It works for me perfectly on v4.1.0-37-gd9362d3, will comment it in #362 as well