Set default SameSite cookie policy to Lax

[sdogruyol]

Summary

Sets the session cookie SameSite default to Lax instead of leaving it unset (nil).

Motivation

• Reduces risk of the session cookie being sent on cross-site requests (CSRF-style chains), in line with common security guidance (“at least Lax”).
• Aligns with defaults or explicit choices in much of the ecosystem (e.g. Flask, Gorilla sessions, Fiber’s direction), while avoiding Strict as the default so first visits from external links (email, search) still behave predictably.

Behavior

Before	After
samesite default nil (attribute omitted; browser-dependent)	HTTP::Cookie::SameSite::Lax

Apps that need the old behavior can use:

Kemal::Session.config.samesite = nil