CookieConfiguration should default to secure configuration and require user opt-out

### Ktor Version
`master`

### Feedback

Currently, the configuration defaults for the Session `CookieConfiguration` defaults to an insecure configuration.

The power of defaults cannot be overstated in a security context.

Instead of defaulting to being insecure, the session cookie should instead default to secure.

Requiring the user to opt-out of the security of these Cookie protections means far fewer default servers will be vulnerable to HTTP downgrade attacks exposing session cookies and will prevent XXS attacks from being leveraged to steal sessions.

https://github.com/ktorio/ktor/blob/583760a04d07c985376ad2f19e656d365adb9a0f/ktor-server/ktor-server-core/jvm/src/io/ktor/sessions/SessionTransportCookie.kt#L83-L86

https://github.com/ktorio/ktor/blob/583760a04d07c985376ad2f19e656d365adb9a0f/ktor-server/ktor-server-core/jvm/src/io/ktor/sessions/SessionTransportCookie.kt#L88-L91

This is not technically a "security vulnerability", it's just an insecure default. This is not unique to Ktor, many libraries default to this "insecure by default" model, but there's no reason why Ktor needs to help perpetuate the insecurity.

I might classify this under [CWE-276: Incorrect Default Permissions](https://cwe.mitre.org/data/definitions/276.html).

Start in ktor-server/ktor-server-core/jvm/src/io/ktor/sessions/SessionTransportCookie.kt at the linked CookieConfiguration defaults. Determine which cookie protections are currently insecure by default and verify the intended opt-out behavior. Done means session cookies use the secure defaults unless the user explicitly disables them, with corresponding tests updated or added.

Written by the indexing model from the issue text.