Add Support for Setting HttpOnly and Secure Flags on NEXT_LOCALE Cookie about next-intl

[amannn]

Hey @Michael-Grupp, thank you for your thoughtful report!

Secure: That's a good point, I've just added #1272 to add this. Do you by chance know if this could be a breaking change for any consumers? As far as I can tell only, in case someone would host a Next.js app without HTTPS, which seems very unlikely to me. Would you agree?

HttpOnly: This is currently not set, because next-intl does in fact change the cookie on the client side (see #790). I understand that ideally we'd not have to do this, but due to the way Next.js works, this is currently necessary as far as I can tell.

One alternative is to manually set these flags on the cookies after they are created by next-intl, but this approach is less desirable

I agree, ideally next-intl would work out-of-the-box without any changes necessary.