[Bug] Library expects all cookies to be URL encoded

There is some historical ambiguity as to what the cookie value can contain. While there is a convention that the cookie value should be URL encoded, the specs don't seem to enforce this. lambda-api expects that the cookie value be URL encoded string. Any cookie containing a "%" character without a valid sequence will fail cookie decoding and can create an exception and a denial of service.

Fixing this is a bit tricky, as we would still want to correctly URL decode any standard cookie value while supporting non-standard ones. It might be worth discussing the correct solution here.

Some reference I found regarding the permitted characters in a cookie value:

• https://stackoverflow.com/a/1969339
• https://stackoverflow.com/questions/49205195/should-cookie-values-be-url-encoded

The issue does not name a file or test. Start by locating lambda-api's cookie parsing and URL-decoding path, then reproduce a cookie value containing an invalid "%" sequence. Compare valid URL-encoded values with non-standard cookie values; done means malformed input no longer raises an exception while standard decoding remains correct.