Make OIDC session cookie same site lax by default

[sberyozkin]

Fixes #30797

Unfortunately having a same site strict attribute for all of the OIDC session cookies has proven to be non-viable OOB since any application doing a few extra redirects will start failing.

We'll retain though an option to restrict strictly the session cookie to the same path, which will work for simple applications doing no redirects beyond the default OIDC redirects (ex, only one redirect from Keycloak to the Quarkus path which was used to initiate the authentication) and then it is just GET or POST without any other not same root but same site redirects.

Updated tests: Now samesite is lax by defaut for the session cookie (CodeFlowTest#testCodeFlowNoConsent) but if required it can become strict (CodeFlowTest#testCodeFlowForceHttpsRedirectUriAndPkce - its config requires strict)

[gastaldi]

LGTM

[gastaldi]

@sberyozkin don't forget to include this change in https://github.com/quarkusio/quarkus/wiki/Migration-Guide-3.0

[quarkus-bot]

✔️ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[sberyozkin]

Hi @gastaldi Thanks, This PR, in combination with #30722, are really about restoring the pre-2.16 state of quarkus-oidc when it comes to controlling the same site attribute for OIDC cookies. Before 2.16, there were no SameSite attribute set at all, which defaults to samesite=lax. Now after the 2 last PRs it is back to the same state, but with only difference is that for the session cookie the users will be able to set samesite=strict for the session cookie only if they can verify it is feasible in their setups.

So I'm not sure I'd like to draw much attention to this episode, I'd just like to fix it and pretend it never happened :-).
It is def not a release/noteworhy-feature IMHO, and it is not really a breaking update either, it is more like back-to-good-time label as without the first PR done earlier most users would have to avoid samesite=strict with an extra config and without this PR, quite a few of them will likely have to do the same, see the analysis from the reporter in the linked issue.

I'm sorry for all this mess, I'd only like to say the tests just won't fail, and after the 1st PR I confirmed I could see a working application (I may have been using Chrome, not sure 100% now).

Would you mind if I drop these 2 labels ?
Thanks

Let me merge anyway, we can continue discussing the labels here

[sberyozkin]

@gastaldi I guess given that it might work for some applications, having session cookie same site strict, you are right, it is worth mentioning it as a breaking change, and I'll update the migration guide now. But yes, I'll just drop the label marking it as a noteworthy feature :-)

[sberyozkin]

@gastaldi FYI, https://github.com/quarkusio/quarkus/wiki/Migration-Guide-3.0#samesite-is-lax-by-default-for-oidc-session-cookie