Heimdall attempt cookie: a deletion carries only the Path

HttpOnly, Secure and SameSite on a deletion decide nothing (a cookie is matched on name and path); Stryker found those two booleans surviving. The deletion is pinned by path, expiry and the absence of Max-Age.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs

@@ -420,14 +420,8 @@ public static class HeimdallAttemptCookie
     };
 
     /// <summary>
-    /// The options a deletion carries: the attempt cookie's Path, which a cookie is matched on, and no Max-Age,
-    /// which would take precedence over the expiry Delete writes and leave the emptied cookie alive.
+    /// The options a deletion carries: only the attempt cookie's Path, which a cookie is matched on. It carries no
+    /// Max-Age, which would take precedence over the expiry Delete writes and leave the emptied cookie alive.
     /// </summary>
-    public static CookieOptions DeleteOptions() => new()
-    {
-        HttpOnly = true,
-        Secure = true,
-        SameSite = SameSiteMode.Lax,
-        Path = "/auth/heimdall"
-    };
+    public static CookieOptions DeleteOptions() => new() { Path = "/auth/heimdall" };
 }