Set `__Host-Http` prefix for session cookies by default

We should make the Quarkus OIDC session cookie name start with the `__Host-Http-` [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies) to enforce strong cookie security properties on the session cookie.