Fine tune EUS flask-session config

Apart from generic hardening, we also need to set the Flask session
directory in order to be able to restrict the default umask (YDA-5565)

roles/yoda_external_user_service/defaults/main.yml

@@ -17,6 +17,11 @@ eus_api_fqdn: api.eus.yoda.test
 eus_api_port: 8443
 eus_api_secret: PLACEHOLDER
 
+# Flask-session configuration
+yoda_eus_cookie_samesite: Strict             # 'Strict' or 'Lax'
+yoda_eus_session_lifetime: 30 * 60           # in seconds, so 30 minutes
+yoda_eus_session_dir: '/tmp/eus_session/'    # default flask session dir
+
 eus_db_host: localhost
 eus_db_port: 5432
 eus_db_name: extuser

roles/yoda_external_user_service/templates/flask.cfg.j2

@@ -6,7 +6,16 @@ YODA_EUS_FQDN       = '{{ yoda_eus_fqdn }}'
 CSRF_TOKENS_ENABLED = 'true'
 API_SECRET          = '{{ eus_api_secret }}'
 EUS_TITLE_TEXT      = 'Yoda External User Service'
-SESSION_TYPE        = 'filesystem'
+
+# Flask-Session configuration
+SESSION_TYPE                = 'filesystem'
+SESSION_COOKIE_NAME         = '__Host-session'
+SESSION_COOKIE_HTTPONLY     = True
+SESSION_COOKIE_SECURE       = True
+SESSION_COOKIE_SAMESITE     = '{{ yoda_eus_cookie_samesite }}'
+PERMANENT_SESSION_LIFETIME  = {{ yoda_eus_session_lifetime }}
+SESSION_USE_SIGNER          = True
+SESSION_FILE_DIR            = '{{ yoda_eus_session_dir }}'
 
 # Theming configuration
 YODA_THEME_PATH     = '{{ yoda_theme_path }}' # Path to location of themes