Enhance scrubbing for session and csrf cookies

For ASP.NET Core and ASP.NET integrations, we should ensure that session and csrf cookies are *always* scrubbed client-side, regardless of `SendDefaultPii` option.

For session cookies, we should specifically look at Cookie-based authentication. (Token-based auth is not affected.)

For ASP.NET Core:
- https://learn.microsoft.com/aspnet/core/security/authentication/cookie
- https://learn.microsoft.com/aspnet/core/security/anti-request-forgery#cookie-based-authentication

For ASP.NET Framework:
- TODO: Find doc for cookie-based auth
- https://learn.microsoft.com/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks