update guide to reflect default HMAC SHA1 in MessageVerifier used in SignedCookieStore

At some point the docs got out of sync with the actual changes implemented in the encrypted cookie store, from what I can see. Default seems to have reverted to HMAC SHA1 for compatibility reasons, this commit updates the docs to reflect that change.

Fixes issue #11670