Retain authentication cookies within handoff size limits

[Linuxuser67]

Summary

Fix cookie selection and payload sizing for authenticated extension handoffs. Companion Grab-side fixes: Grab #499.

• Prioritize cf_clearance, __Host-, __Secure-, and other authentication/session cookies when applying Grab's 100-cookie limit.
• If the serialized JSON body exceeds the 30 KiB target, remove lower-priority cookies first and prefer dropping the largest serialized cookies within each priority.
• Preserve the URL and user agent and retain critical authentication cookies whenever they fit. The pairing HMAC is still computed over the final serialized body.
• Replace the regression test that expected all cookies to be dropped with coverage for cookie-count prioritization, oversized jars, retained authentication cookies, payload size, and the final body signature.

Validation

• The extension's CI check workflow passed on the current PR head, including the revised payload-limit tests.