Port remaining cookie middleware changes from Katana.

The cookie middleware and security base package were ported to vNext before Katana v3 shipped. This PR ports the changes that happened since the original port.

Depends on https://github.com/aspnet/HttpAbstractions/pull/125
AFAIK, `ClaimsPrincipal.Identity` is not guarded against null values, given that a principal can be built with an empty list of identities. Even if the built-in security middleware shouldn't construct such empty principals, adding a new null check for `context.User.Identity` might be a good idea to warn end devs of this possibility.