Do not update VCAP_ID cookie without JSESSIONID cookie

[hoffmaen]

• Read the Contributing document.

Summary

This Pull-Request fixes Problem 1 in #529.

This Pull-Request fixes an issue where Gorouter was creating an unpartitioned __VCAP_ID__ cookie when a client's original sticky session endpoint became unavailable and the backend response didn't contain a JSESSIONID cookie. The previous behavior would set a new __VCAP_ID__ cookie with default attributes whenever the endpoint changed, regardless of whether the application intended to establish a new session. With this change, Gorouter only sets the __VCAP_ID__ cookie when the backend response explicitly contains a JSESSIONID cookie or WWW-Authenticate Negotiate header, ensuring that cookie attributes remain synchronized and applications maintain full control over session lifecycle.

Backward Compatibility

Breaking Change? Yes (but more of a bugfix)

This Pull-Request changes the behavior of VCAP_ID cookie creation in a specific scenario: when a client sends both JSESSIONID and __VCAP_ID__ cookies, the original endpoint is no longer available, and the backend response doesn't contain a new JSESSIONID cookie. Previously, Gorouter would create a new __VCAP_ID__ cookie with default (unpartitioned) attributes in this case.
With this change, Gorouter will not create a new __VCAP_ID__ cookie unless the backend explicitly sets a JSESSIONID cookie in the response. This prevents cookie attribute desynchronization where JSESSIONID and __VCAP_ID__ could have conflicting partitioning states. The previous behavior was problematic because applications lost control over the __VCAP_ID__ cookie attributes (particularly when using partitioned cookies), as Gorouter would override them with unpartitioned defaults. This fix ensures applications can properly control cookie sandboxing through JSESSIONID attributes.

[b1tamara]

LGTM

[hoffmaen]

Putting this back to Draft status, to align of broken scenarios.