Update alert banner cookie to set samesite="lax"

[rgcarr]

Added SameSite default setting to Cookie

[andybroomfield]

Thanks for this @rgcarr

I've tested and the banner still hides, and I'm no longer seeing a warning in firefox consiole.
We should review at some point if 'lax' is the right value here, and if secure (which EU cookie complicance uses) would be better. Also need to look at if we should send secure if under https. These can be looked at as seperate issues though.

[andybroomfield]

Some more info on samesite
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#browser_compatibility

[rgcarr]

I did some testing with SameSite: None (which seemed most flexible option), but you have to implement Secure... and didn't think we can assume that a site is always running HTTPS (errors if Cookie is "Secure' but running HTTP). Lax seemed to be path of least resistance.

[ekes]

And on the same day https://www.drupal.org/node/3275352 "Drupal now defaults to "Lax" for the SameSite session cookie attribute, and checks for valid values. Introduced in version:
10.1.0" 😄