Enable the HttpOnly flag for experimentation_subject_id cookie

This mitigates some OWASP issues.

Closes https://gitlab.com/gitlab-org/gitlab/issues/34851

changelogs/unreleased/sh-set-httponly-experimentation-subject-id.yml

+---
+title: Enable the HttpOnly flag for experimentation_subject_id cookie
+merge_request: 19189
+author:
+type: security

lib/gitlab/experimentation.rb

@@ -38,7 +38,8 @@ module Gitlab
         cookies.permanent.signed[:experimentation_subject_id] = {
           value: SecureRandom.uuid,
           domain: :all,
-          secure: ::Gitlab.config.gitlab.https
+          secure: ::Gitlab.config.gitlab.https,
+          httponly: true
         }
       end