Add admin options for session cookie samesite = none / lax / strict

Split from MDL-67175, this add back in the to ption keep and / or increase the samesite cookie security level.

1) add new admin setting in http security

2) also add this to the security report tool