DEV: Set `samesite=lax` on cookies set by client-side (#26559)

Chrome's default is already Lax, so this change is a no-op there.

Firefox will soon be follow them, and has started warning about cookies with no samesite attribute. That's the motivation for this commit.

app/assets/javascripts/discourse/app/lib/cookie.js

@@ -36,6 +36,7 @@ function cookie(key, value, options) {
       options.path ? "; path=" + options.path : "",
       options.domain ? "; domain=" + options.domain : "",
       options.secure ? "; secure" : "",
+      ";samesite=Lax",
     ].join(""));
   }