Allow setting insecure cookie

[bjarkebm]

Description

Currently, the cookie set is always Secure unless running on localhost or when NODE_ENV is not production.
When deploying code to a non-https site that has NODE_ENV=production, setting the cookie will fail.
Our use-case is deploying PRs to a dynamically created environment, where we test that everything is working as in production (thus, we have NODE_ENV=production), but the environment is a random url, and so cannot have https (at least easily).

The proposed solution is to allow setting an environment variable that turns off setting the cookie as secure, AUTH0_ALLOW_INSECURE_COOKIE=true

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[bjarkebm]

I decided to rearrange the tests a little to make it clearer when the tests are for production environment (all tests but one), and for when they are not-production (just one test)

[sandrinodimattia]

Excellent, thank you! 🙇 Will be available in the next release.