update SameSite cookie settings

https://github.com/DemocracyLab/CivicTechExchange/blob/17ab670975f9bfa0de8f5b033eaccdc92e9d3a96/democracylab/settings.py#L377-L379

Currently, if not in debug mode, [HTTP cookies have SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value) set to `None; Secure`. However, `Lax` is the current suggested default, both from Django and from major web browsers. The dlab use case for None has been removed, and if we need to set cookies with None in the future, we can [make exceptions](https://docs.djangoproject.com/en/4.2/ref/request-response/#django.http.HttpResponse.set_cookie), but it should not be the global default.

So, to solve this issue:
- update django to use Lax instead of None in prod environments (leave the if not DEBUG conditional alone)
- ensure local dev environments don't break
- ensure production environments don't break

This is a bit open ended - I'm not sure what problems may occur here. So please make sure to test as many actions as possible that involve cookies (e.g. log in and log out, actions which require being logged in like create a project, edit a project, update a user profile, etc) -- and if you have any specific information on other security settings we should look at, please tell me so.

Django docs:
- https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-CSRF_COOKIE_SAMESITE
- https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SESSION_COOKIE_SAMESITE