feat: implements injected cookies encoding respecting http state management rfc

[big-kahuna-burger]

Summary

• inject({ cookies }) now encodes cookies onto the Cookie header using RFC 6265 §5.1.4 path matching, so a cookie with Path=/account/123 is not sent to /account/other.
• Accepts the existing name: value map (no path → treated as Path=/), name: { value, path } records, or a previous res.cookies array.
• Docs live in docs/cookies.md (so I don't pollute a nice readme with extra hunk related to cookies only); the generated lib/config-validator.js allows a cookie array as well as an object.

Test plan

• npm test (lint, 100% unit coverage, tstyche)
• Confirm string cookies still go out on every path: { session: 'abc' }
• Confirm a scoped cookie is omitted when the request path does not match
• Confirm a scoped cookie is sent when the request path is a valid RFC 6265 prefix (/account/123 → /account/123/settings, not /account/other or /docsets vs /docs)
• Replay login.cookies onto a later inject and check only matching cookies appear on Cookie

Checklist

• run npm run test && npm run benchmark --if-present
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[mcollina]

lgtm