docs: note secure/httponly defaults and the replay rationale

[sebdroid]

Marks secure and httponly as "(default: off)" in the configuration block, matching the existing annotation on block_unencrypted, and adds a one-line recommendation below it:

Enable secure whenever you serve over HTTPS: encryption stops a stolen cookie being read, but not replayed, so keeping cookies off plain HTTP still matters.

Both flags genuinely default to off (plain Go bools, no provisioning default) - this just makes the docs say so and explains why turning secure on is worthwhile even though values are encrypted.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.