refactor(cookies): replace the cookie jar with the store gRPC already uses

[lakhansamani]

Follow-up to #11. That PR added a cookie jar; this removes the need for one.

The insight

The gRPC transport in this SDK has always carried cookies as a plain dict[str, str] — captured from set-cookie metadata, replayed as one cookie entry. No jar, no policy. Meanwhile the HTTP transports used http.cookiejar, which implements a user agent: domain matching, public-suffix rules, a policy layer.

An SDK talks to exactly one origin, fixed at construction. Every one of those rules is either inapplicable or a source of breakage — and it supplied both:

• Secure cookies dropped over http://localhost
• dotless-domain mismatch (localhost vs localhost.local)
• set_ok-vs-set_cookie layering that made fix: persist MFA session cookie so skip_mfa_setup works #11's first fix silently do nothing on Python 3.9/3.10

HTTP now uses the same store gRPC already had. One implementation, one cookie store per client — so a client that switches protocol keeps its session.

What the jar was doing that still gets done

• Secure is still honoured (RFC 6265 §4.1.2.5): not stored when the client's own origin is plain http and not loopback. Loopback is excepted because Secure Contexts makes it trustworthy — the same call Chrome, Firefox and Go's stdlib jar make, and RFC 6265bis §5.6 explicitly delegates it to the user agent.
• Max-Age<=0 still deletes, so logout / DeleteMfaSession clear the handle instead of leaving a dead one replayed forever.
• Origin scoping is now structural, not policy: every RequestSpec is built from config.authorizer_url, so no code path attaches the store to another host. Pinned by a test that fails if one appears.

The cookie-injection hole #11's shim introduced cannot recur — with one origin there is no second host to accept a cookie from.

Verification

• ruff, mypy, pytest clean on 3.9, 3.10, 3.11, 3.12, 3.13
• a real MFA flow against a running server: signup withholds → skip_mfa_setup redeems → token issued
• the 56-test live integration suite, green
• the three adversarial tests rewritten for the new design (cross-origin, Secure, deletion) rather than deleted

Server-side contract documented in authorizerdev/docs#93.