Revisit Secure token attribute

Use another way to check weather or not we need to use `secure` cookie. When TLS is enabled cookies should be secured, when it's not enabled it should not. (Otherwise auth will fail and other cookie based workflow too).

Currently we check the config for a certificate to decide that, but most of the time a proxy handles the TLS termination so we should maybe also check `request.secure` or something related to proxy headers forwarding.

More context here:
https://github.com/apache/airflow/pull/47859#issuecomment-2729487918

Start by locating the current secure-cookie decision and read the linked pull request discussion about TLS termination. Trace how request security and forwarded proxy information are represented, then verify the behavior for direct TLS and proxy-terminated TLS. Done means cookie security matches the effective connection and authentication and other cookie-based workflows continue to work.

Written by the indexing model from the issue text.