Change expiration of PKCE and State cookies from explicit date to max-age to allow for client clock skew

[hex2bit]

Goals

1. Make PKCE and State cookies not dependent on client clock accuracy.

Non-Goals

No response

Background

This is related to issue #4660, where a max-age setting was made available for the PKCE and State cookies (thank you for adding that). However, the expiration set on the cookie is based on the server clock while the cookie's lifespan is based on the client's PC clock. I've run into issues with users unable to log in because their clock is too far off from the server to be able to ever complete the auth workflow. The only workaround would be to increase the cookie max age to significantly higher, which is less secure and game of "guess how far off your users' clocks are".

By changing the expiration on the cookies over to use the "max-age" cookie property instead of the "expires", it will correctly allow the lifespan of the cookie to exist on the client for the desired amount of time and would simplify the code (no need to calculating date).

I did not dig into the possibility of other similar cookies, but if there's others being handled similarly, it would be good to consider those as well.

Proposal

Change the PKCE and State cookies to use the "max-age" cookie property instead of "expires" to handle lifespan duration.