fix: Support multiple workos-has-session cookies

[cmatheson]

Imagine a setup with multiple environments at varying levels of nesting in a domain:

• environment_1 has auth domain auth.foo-corp.com
• environment_2 has auth domain internal.auth.foo-corp.com

If a user logs in to apps at in both environments, they will end up with multiple workos-has-session cookies. authkit-js used to only look at the first cookie (effectively allowing one environment to shadow the other).

This lets authkit-js read from every cookie the browser sends.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness, security, or repository-rule violations identified.

Summary

This PR updates browser session detection to inspect every workos-has-session cookie rather than only the first, preventing an overlapping cookie from hiding the session marker for the current WorkOS client.

• Iterates all same-named cookies and succeeds when any value contains the current client ID.
• Preserves support for the legacy "1" session marker.
• Adds an initialization test covering two overlapping cookies where the relevant cookie appears second.

_{Reviews (1) · Last reviewed commit: "Support multiple `workos-has-session` co..."}