nexus-2.11.x [NEXUS-7800] add 'shiro.secureSessionCookies' property

Note: this should only be enabled as part of configuring Nexus for HTTPS because it tells browsers to only send the session cookie when the request is going to an HTTPS page: https://www.owasp.org/index.php/SecureFlag

https://issues.sonatype.org/browse/NEXUS-7800
http://bamboo.s/browse/NX-OSSF440-2 :white_check_mark: