Set secure flag on session cookie when running on https

[knolleary]

Part of https://github.com/FlowFuse/security/issues/88

Description

If we know we're running with https configured, we should set the secure flag on the session cookie. We cannot set it always on as that will break localfs installs without https configured.

I believe the test on base_url is the right one to do here. I've checked our helm chart sets that with a https prefix if the https flag is set.

[knolleary]

Going to verify this works as I expect it to on the prestaging setup as I don't have a full https enabled localfs setup.

[codecov]

Codecov Report

Attention: Patch coverage is 50.00000% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 79.25%. Comparing base (05a4c0d) to head (3611e77).
Report is 13 commits behind head on main.

❗ Current head 3611e77 differs from pull request most recent head a7f8d88

Please upload reports for the commit a7f8d88 to get more accurate results.

Files	Patch %	Lines
forge/routes/auth/index.js	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3877      +/-   ##
==========================================
- Coverage   79.26%   79.25%   -0.01%     
==========================================
  Files         281      281              
  Lines       12723    12722       -1     
  Branches     2838     2838              
==========================================
- Hits        10085    10083       -2     
- Misses       2638     2639       +1     

Flag	Coverage Δ
backend	79.25% <50.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[hardillb]

I'll have another look at how hard it would be to do HTTPs on localfs, in theory we should be able to share a single certificate between the forge app and the all the instances, since the certs don't care about port numbers.

[hardillb]

Approved as logically it looks good, but not merged while waiting on pre-staging testing results.

[knolleary]

Have verified the cookie has the secure flag set in the prestaging env. Will merge in the morning.