fix: reject Set-Cookie with SameSite=None but no Secure attribute

Closes https://github.com/dart-lang/sdk/pull/63254

GitOrigin-RevId: 18d7d0e46c31783ff200657c0f81d029e9a64231
Change-Id: I3019e7733b6e2a3e1634b6bb7f8bb5e17be35d4e
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/498423
Reviewed-by: Slava Egorov <vegorov@google.com>
Commit-Queue: Slava Egorov <vegorov@google.com>

sdk/lib/_http/http_headers.dart

@@ -1208,6 +1208,14 @@ class _Cookie implements Cookie {
         // An extension-av, which is not validated or processed.
       }
     }
+
+    // RFC-6265bis currently requires SameSite=None cookies to carry the
+    // Secure attribute.
+    if (sameSite == SameSite.none && !secure) {
+      throw HttpException(
+        "Cookie with 'SameSite=None' must also have the 'Secure' attribute.",
+      );
+    }
   }
 
   String toString() {