[SDK-1878] Express SDK beta should login/logout scoped to a subpath

[adamjmcgrath]

Description

Scope all cookies (skipSilentLogin, transient and appSession) to the app session cookie path and domain config (if specified)

Doing the transient cookies was probably overkill, but it should prevent concurrency issues if a user were to login to 2 sites under different paths on the same domain at the same time 🤷

Testing

Tested using:

const express = require('express');
const { auth } = require('./');
const app = express();
app.use(
  '/foo',
  auth({
    attemptSilentLogin: true,
    baseURL: 'https://localhost:3000/foo',
    session: {
      cookie: {
        path: '/foo',
      },
    },
  })
);
app.get('/foo', (req, res) => {
  res.send(`hi ${req.oidc.user.name}`);
});
app.listen(3000, () => {});

• Added test coverage for app session cookie - existing coverage handles the default (no path/domain case)

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master