Audit Set-Cookie attributes for Secure, HttpOnly, SameSite, and RFC 6265bis __Host- prefix compliance.