#3 Merge Guzzle 8.3.1 cookie fixes

This merges upstream Guzzle 8.3.1. It fixes cookie updates that could leave an old cookie active or renew an expired cookie when loading a saved jar.

• Expired cookies now remove the matching stored cookie instead of being stored themselves. This also drops expired records when loading saved jars. (guzzle/guzzle#3987)
• A cookie with the same value now replaces an existing cookie when its expiry, Discard, Secure or HttpOnly flag changes. Exact duplicates remain unchanged. (guzzle/guzzle#3990)
• Cookies reconstructed from arrays keep their stored expiry rather than receiving a fresh Max-Age lifetime. Parsing a Set-Cookie header still gives Max-Age precedence over Expires. The upgrade guide reflects that distinction. (guzzle/guzzle#3991)
• The delayed-request test measures attachment separately from response completion, preventing a pending sibling request from making the timing assertion flaky. (guzzle/guzzle#3994)

The merge preserves the fork's coroutine ownership checks, pooled handlers, global middleware and idle-handle settings. No fork-specific source adjustments were needed.

Validation: affected cookie and cURL multi-handler tests, session-cookie loading tests, PHPStan, formatting, Composer normalization and platform checks pass. Existing platform-dependent cURL test skips remain.

---

Summary by cubic

Merges upstream Guzzle 8.3.1 cookie fixes. Cookie storage now removes expired cookies instead of storing them, and persisted cookies keep their original expiry instead of restarting their lifetime when loaded.

Bug Fixes

• Expired cookies delete the matching stored cookie, including expired records dropped when loading saved jars.
• Same-value cookies replace the existing entry when expiry or the Discard, Secure, or HttpOnly flags change; exact duplicates stay unchanged.
• Rebuilt Max-Age cookies keep the stored expiry, while Set-Cookie header parsing still gives Max-Age precedence over Expires.
• The delayed-request test times attachment separately from response completion so a pending sibling request can't make the assertion flaky.

The merge keeps the fork's coroutine ownership checks, pooled handlers, global middleware, and idle-handle settings. No fork-specific source changes were needed.

Summary by CodeRabbit

• Bug Fixes

  • Expired cookies are no longer stored or sent, and can remove a matching cookie already in the jar.
  • Updates to a cookie’s value or attributes are now consistently reflected in the jar.
  • Cookies created from arrays retain their supplied expiration time when loaded, preventing their lifetime from being incorrectly restarted.
  • For cookies parsed from a header, Max-Age takes precedence over Expires.

• Documentation

  • Clarified how Max-Age and Expires behave for parsed and array-created cookies.