Description

Fixes #8488

In cookies._read_set_cookie_pairs, Expires handling assumed that any value with len(rhs) <= 3 was a weekday prefix followed by a comma, without checking whether the delimiter was actually a comma. For headers like Set-Cookie: session=abc; Expires=0; Secure, the parser skipped past the semicolon and consumed Secure into Expires="0, Secure", dropping the Secure attribute. In addition, RFC 850 dates with full weekday names (Wednesday, ...) failed the length check and were prematurely split into phantom cookies.

Approach chosen:

1. Define _WEEKDAYS containing RFC 1123 and RFC 850 weekday names.
2. Only consume across a delimiter if the delimiter encountered was strictly a comma (off < len(s) and s[off] == ",") AND the parsed value corresponds to a weekday name (rhs.strip().lower() in _WEEKDAYS).
3. Added test cases covering:
   • Expires=0 followed by Secure; HttpOnly
   • Comma-separated multiple cookies with expires=0
   • RFC 850 full-weekday dates with single and multiple cookies

Verification:

• uv run pytest test/mitmproxy/net/http/test_cookies.py (11/11 tests pass).
• uv run pytest test/mitmproxy/net/http/ (113/113 tests pass).
• uv run ruff check and uv run ruff format --check (clean).

Checklist

• I have updated tests where applicable.
• I have added an entry to the CHANGELOG.