Potential fix for code scanning alert no. 3: Clear text transmission of sensitive cookie

[Ushcode]

Potential fix for https://github.com/TheWorldAvatar/viz/security/code-scanning/3

To fix the problem, we need to ensure that the session cookie is only transmitted over secure connections by setting the secure attribute to true. This can be done by modifying the session configuration to include the secure attribute. Additionally, we should set the httpOnly attribute to prevent client-side scripts from accessing the cookie, further enhancing security.

• Modify the session configuration in the server.use(session({... block to include the secure and httpOnly attributes.
• Ensure that the secure attribute is conditionally set based on the environment (e.g., only set to true in production).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Ushcode]

• NB this is a breaking change for deployments. It is now necessary to generate a unique SESSION_SECRET variable on the server before a production deployment with keycloak. See auth section of the main docs for guidance.
• Address security vulnerability 3
• Address security vulnerability 5