Cookie Attribute Audit

Parse Set-Cookie headers and report their attributes. Names cookies with no Secure, no HttpOnly or no SameSite; SameSite=None without Secure, which browsers reject so the cookie is never set at all; an unrecognised SameSite value, where the default applies instead; a lifetime beyond a stated maximum; an unexpected Domain; and a Domain attribute at all, which widens a cookie to every subdomain. No cookie value is returned, only its length.