http: making routing cookies HttpOnly, allowing configured paths (#3533)

Risk Level: Low
Testing: new unit tests
Docs Changes: config documented inline.
Release Notes: added in #3462
Fixed #3532

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>

Mirrored from https://github.com/envoyproxy/envoy @ 5c7027c34e93fa0cb0574e74757dab637b847255

envoy/api/v2/route/route.proto

@@ -524,6 +524,10 @@ message RouteAction {
       // not present. If the TTL is present and zero, the generated cookie will
       // be a session cookie.
       google.protobuf.Duration ttl = 2 [(gogoproto.stdduration) = true];
+
+      // The name of the path for the cookie. If no path is specified here, no path
+      // will be set for the cookie.
+      string path = 3;
     }
 
     message ConnectionProperties {