auth0_nonce and auth0_state cookies are set without the secure flag

[phy9pas]

When setting these state cookies, if the site is using https then it should set the secure flag to try when using setcookie.
This will ensure the cookie is only available over https.

This related to
WP_Auth0_Nonce_Handler.php
line 193

[evansims]

Hi @phy9pas 👋 Thanks for your suggestion. This is not a viable option because we found many users run the plugin in non-TLS environments, and often in environments behind proxies that do not accurately inform PHP using environment variables that it should be considered running in HTTPS.