The default value for SameSite in Chromium-based browsers has been set to Lax since 2020. This breaks some less-common use cases such as iframing the site, but just as importantly, results in inconsistency across browsers because neither Firefox nor Safari do the same.

Since the minimum supported version of PHP is now > 7.3 we can switch to using the array signature for setcookie() options and specify a value for the SameSite flag.

In order to standardise setting SameSite to Lax in all browsers, facilitate being able to change the SameSite value (either to tighten it to Strict or loosen it to None), and to make everything more testable, this PR makes the following changes:

• Adds a wp_set_cookie() wrapper function with filters for controlling the cookie options and whether cookies are sent. This increases the testability of functions that set cookies.
• Adds a wp_unset_cookie() function as a convenience wrapper for unsetting cookies.
• Explicitly sets the samesite option to Lax. I have not identified any cookie that's set by WordPress that would benefit from a SameSite value of Strict, and none that need downgrading to None.

Supporting info

Drupal, Symfony, Laravel, Django, RoR, ASP.NET, Magento, and many other frameworks default to explicitly setting SameSite to Lax rather than relying on an implied default in browsers.

Trac ticket: https://core.trac.wordpress.org/ticket/37000