chore(oauth-provider): upgrade cookie to 2.x, drop @types/cookie

[dreyfus92]

What & why

this bumps cookie from 0.7.0 to 2.0.1 in the oauth-provider package and drops @types/cookie since cookie ships its own types now.

the 2.x api renames a couple things so i migrated to parseCookie / stringifySetCookie, and added a Math.floor() on maxAge because 2.x throws on non-integers.

the fun part was that a global pnpm override was silently pinning cookie to 0.7.2, so i scoped it to express>cookie instead, express keeps its patched version and oauth-provider gets 2.0.1. left a TODO noting the override can go away once express 5 lands. full build, unit tests and the pds oauth integration tests all pass.

related: #5341

Checklist

• pnpm build --force && pnpm verify passes
• Tests pass, and new behavior is covered by tests
• A changeset is included for every package this touches
• Written with the help of an LLM or coding agent? Say so here, and name the tooling.