[FEATURE] Enable cookieHttpOnly by default

Enable cookieHttpOnly by default, which prevents
JavaScript from accessing the session cookie

Resolves: #24647
Releases: 6.2
Change-Id: Id000c9221232aeae325c82db079539564cd36b93
Reviewed-on: https://review.typo3.org/25122
Reviewed-by: Ingo Schmitt
Reviewed-by: Oliver Klee
Reviewed-by: Wouter Wolters
Reviewed-by: Steffen Müller
Tested-by: Steffen Müller