Set ZeroOpts=tls cookie for HTTPS-enabled Zero clients

With guards against:
  Setting the cookie when it's already present from the origin
  Setting the cookie when the client is already sending it

To be reverted 30 days after merge, which gives time for
  the origin to set the cookie itself in the caches varied
  via X-CS.

Change-Id: I9db747c37a30d0ec1452ad0dacea094a7ec63721