Cookie hardening: set Secure flag and document consent/GDPR implications

[loevgaard]

Problem

Two hardening/compliance gaps around the attribution cookie:

1. Missing secure flag. CookieHandler::set() builds the cookie with Symfony defaults, where secure resolves to false. On an HTTPS shop the cookie should be marked Secure (httpOnly true and SameSite=Lax defaults are already fine).
2. No consent integration / documentation. This is a marketing/tracking cookie under ePrivacy/GDPR, and the conversion ping sends the customer's IP address to a third party. The plugin sets the cookie unconditionally with no consent hook, which merchants in DK/EU need to be aware of.

Suggested fix

• Set secure: true on the cookie (or make it configurable alongside name/expiry).
• Document the consent/GDPR implications in the README, and/or provide an extension point so integrators can gate the cookie on their consent solution.

Affected code

• src/CookieHandler/CookieHandler.php
• README.md