Currently, we have no way to define the SameSite cookie attribute for sessions/affinity/sso without relying on an expression filter.
Servlet 6.0 added support for arbitrary cookie attributes via Cookie.getAttributes(), setAttribute(...), etc.
To facilitate this, we should add an "attributes" attribute of type Map<String, String> to AbstractCookieResourceDefinition that allows configuration of name/value pairs to add to the ServletSessionConfig of a DeploymentInfo.