[php-src] Issue #7913: Vulnerability due to insecure default values of session.cookie_secure and session.cookie_httponly

Issue: https://github.com/php/php-src/issues/7913 Author: etkaar ### Description Dear colleagues, it seems that the default values for the SECURE and HTTPONLY flags of cookies, **especially** for the PHP session cookie, (PHPSESSID) are not set to true. This opens a **hidden** vulnerability for serious XSS attacks. Developers which use [setcookie()](https://www.php.net/manual/de/function.setcookie.php) and explicitly define $secure and $httponly might not be aware, that they additionally have to explicitly set these values in [session_set_cookie_params()](https://www.php.net/manual/en/function.session-set-cookie-params.php) to protect the PHPSESSID cookie from being stolen due to trivial XSS attacks. I kindly ask you to confirm this issue and move to secure-per-default for this. Kind Regards, etkaar ### PHP Version PHP 7-8 ### Operating System _No response_