Merge branch 'sh-set-httponly-experimentation-subject-id' into 'master'

Enable the HttpOnly flag for experimentation_subject_id cookie

Closes #34851

See merge request gitlab-org/gitlab!19189

changelogs/unreleased/sh-set-httponly-experimentation-subject-id.yml

+---
+title: Enable the HttpOnly flag for experimentation_subject_id cookie
+merge_request: 19189
+author:
+type: security

lib/gitlab/experimentation.rb

@@ -38,7 +38,8 @@ module Gitlab
         cookies.permanent.signed[:experimentation_subject_id] = {
           value: SecureRandom.uuid,
           domain: :all,
-          secure: ::Gitlab.config.gitlab.https
+          secure: ::Gitlab.config.gitlab.https,
+          httponly: true
         }
       end