tests(oidc) :: pin auth cookie attributes in test

[81reap]

set_auth_cookie sets sqlpage_auth with Secure, HttpOnly, SameSite=Lax and
path=/. No test checks any of them. test_oidc_happy_path runs the whole login flow,
but it only checks that the callback redirects and that the next request returns 200.

The test now reads sqlpage_auth from the callback's Set-Cookie headers and asserts
all four attributes.

[lovasoa]

empty description = draft

[81reap]

this is it, there's nothing more. the PR title is self descriptive. its just improving gaps in testing that was found by #1396. This would have gone with #1423 but following the ask in #1412 I've broken this out into a separate PR since it doesn't really help #1423