fix(Change-encryption-mode): From AES-256-CBC to AES-256-GCM

[jmjimenezlp]

Due to the security audit done in this project is required to change the encryption used: https://dojo.fpkmon.com/finding/2213

---

Note

Medium Risk
Changes the on-the-wire cookie format and encryption algorithm, so any downstream decryptor (e.g. Akamai) must be updated in lockstep. Crypto refactor also removes the fixed/random IV modes, which could break existing configurations relying on them.

Overview
Migrates cookie encryption from AES-256-CBC to AES-256-GCM (AEAD), generating a fresh random 12-byte nonce per request and encoding cookies as base64(nonce || sealed) (ciphertext + tag).

Removes CBC-specific configuration (iv_mode and CEEP_ENCRYPTION_IV) and updates the plugin to always use GCM when not in set_static_cookie_value mode.

Hardens the emitted cookie by adding HttpOnly; Secure, and updates README.md plus docs/samples/istio-wasmplugin.yaml to reflect the new format and decryption steps.

^{Written by Cursor Bugbot for commit 421c01f. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[achetronic]

Hey, hey, not possible in akamai to decrypt using all the algorithms you want. Just accepting two of them for AES256

CC: @devploit