Port remaining cookie middleware changes from Katana.

The cookie middleware and security base package were ported to vNext before Katana v3 shipped. This PR ports the changes that happened since the original port.

Depends on https://github.com/aspnet/HttpAbstractions/pull/125
Indeed, thanks @Eilon.