We should cleanup unused cookies when switching between chunked and unchunked

[adamjmcgrath]

Description

If the size of the session grows from <4096 Bytes to >4096 Bytes, the middleware will create new appSession.0 ..., appSession.n chunked cookies.

But it will not remove the orginal single appSession, and since the cookie-store prefers appSession, it will continue to read the stale single cookie rather than the updated chunked cookies.

References

fixes #289

Testing

• Login with small session (eg. database user with no custom claims)

• Observe that you have a single appSession cookie

• Hit some middleware that adds a large value to your session (making the session > 4096 Bytes)

• Observe that you have new appSession.0 and appSession.1 cookies - you should not have the appSession cookie

• You should be able to read the value of the new property on subsequent requests

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/auth0/nextjs-auth0/48ejq4gr0
✅ Preview: Canceled

[Deployment for af6f210 canceled]