Play Framework

fix: honor application.session.sameSite config for session and flash cookies (PF-7)

Wires application.session.sameSite from application.conf into the
session and flash cookie write paths, closing the only remaining gap
in PF-7. Http.Cookie.sameSite and the Netty serializer were already
landed by Audit B9, but Scope/CookieSessionStore had no read of the
config knob the ticket explicitly calls out.

The old PF-7 branch is not cherry-pickable: it predates PF-78 (the
Scope refactor that moved the session-store split into
CookieSessionStore.save) and Audit B9 (Http.Cookie.sameSite + the
Netty mapping). A fresh, minimal implementation is cleaner.

Defensive Secure auto-upgrade: per the SameSite spec, SameSite=None
requires Secure. Modern browsers reject None-without-Secure cookies
outright, so the Session/Flash write path forces secure=true when
COOKIE_SAMESITE equals "None". This guard lives at the cookie-set
site (Scope.applySameSite), not in Http.Cookie itself, so apps that
hand-build cookies with None+insecure stay responsible for their
own choices.

COOKIE_SAMESITE is non-final (matching the existing
SESSION_SEND_ONLY_IF_CHANGED precedent) so tests can override the
default at runtime without classloader gymnastics.

Tests added to SessionTest cover the default, custom-from-config for
both Session and Flash cookies, and the None-forces-Secure path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>