[chfsx]

The cookie API of HTTP (Cookie, CookieJar, CookieFactory, CookieJarFactory) is free of library types, but HTTP did not offer the CookieFactory as a service. Consumers therefore instantiated CookieFactoryImpl themselves, and a test built cookies from Dflydev\FigCookies\SetCookie directly. This PR offers the factory through the HTTP services, switches the consumers to it and keeps dflydev/fig-cookies an implementation detail of HTTP. Same approach as #12266 (guzzlehttp/psr7) and #12267 (pimple/pimple).

HTTP

• The CookieFactory is defined and implemented in the bootstrap ($use[CookieFactory::class]) and available to legacy code as $DIC->http()->cookies() (new method on GlobalHttpState).
• CookieWrapper and CookieJarWrapper are marked @internal; they are only created by the factories.
• README: the rule (no implementations, no Dflydev\FigCookies\* outside of HTTP) and examples using $dic->http()->cookies(). The examples also discarded the result of the immutable withPath(); fixed.

Components

• ilUtil::setCookie(), ilWACSignedPath and wac.php use the CookieFactory of the HTTP services instead of new CookieFactoryImpl().
• The deactivated ilWACTokenTestTBD no longer uses SetCookie/CookieWrapper.
• GlobalScreen: ModeToggle is removed. It had no caller ("This is just for testing!!! And will be removed after").
• User: the WAC secure path usr_images is removed from service.xml. Profile pictures are stored in the IRSS, nothing is written to usr_images any more. Existing installations keep the row in il_wac_secure_path, as ilSecurePathDefinitionProcessor::purge() does not remove paths; it still points to ilObjUserAccess, which is unchanged.

Overlap with #12266

Both PRs add a method to GlobalHttpState/RawHTTPServices/Services and a factory to HTTP.php, InitHttpServices, wac.php, HTTPServicesTest and the README of HTTP. Whichever is merged second needs a rebase with small, unambiguous conflicts.

Testing

• Build: [OK] All static artifacts are build!
• PHPUnit, whole suite: green except RootFolderTest, which only fails locally because of untracked files in the root folder of my checkout.
• Code rules gate on components/ILIAS: green. php-cs-fixer on the changed files: clean.
• On a trunk installation, in the browser: logout and login (sets and resets ilClientId via ilUtil::setCookie()), a SCORM module started and navigated: the player signs the folder with ilWACSignedPath::signFolderOfStartFile() and all files of the module are delivered through wac.php. A file signed with ilWACSignedPath::signFile() is delivered through wac.php as well.

@fwolf-ilias @Uwe-Kohnle for WebAccessChecker, @kergomard for User, @mjansenDatabay @thibsy for Init. Utilities is unmaintained.

If there are no objections, I will merge this before Coding Completed.