fix(auth): restrict non-secure cookie fallback to development environment

[nyxsky404]

This PR removes the fallback to the non-secure next-auth.session-token in production environments. Previously, if the __Secure-next-auth.session-token was missing in production, the middleware would attempt to read the insecure cookie by explicitly setting secureCookie: false. This introduces a severe Session Hijacking vulnerability via Cookie Tossing, allowing attackers to inject insecure session cookies on production instances. The fallback is now strictly limited to development environments, ensuring production requests without the secure cookie are appropriately treated as unauthenticated. Fixes #3167.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus