Port remaining cookie middleware changes from Katana.

The cookie middleware and security base package were ported to vNext before Katana v3 shipped. This PR ports the changes that happened since the original port.

Depends on https://github.com/aspnet/HttpAbstractions/pull/125
You don't need any of these. Nuke all dependencies here