Remove cookie name decoding

[Tratcher]

dotnet/aspnetcore#23578 dotnet/aspnetcore#24264

Decoding arbitrary input allows spoofing of special inputs like __Host- with encoded values like __%48ost-.

Fix: Only compare to known values. e.g. the key the developer passes in with the encoding we would have used.

This fix works seamlessly for the indexer but leaves the encoded value in enumerator.

Note Katana does not have quirks or AppContext switches. That should be OK because Katana is not bundled as part of a framework, it's an opt-in package upgrade.

This PR had to do a little more more work than the AspNetCore 2.1 version because Katana shared the same parser for cookies, forms, and query strings. The three are close, but there are a few differences people have complained about (aspnet/HttpAbstractions#547). AspNetCore changed to using a separate parser for each data type a long time ago.

TODO: versioning. This will probably be versioned as 4.1.1.

[bvmeer]

We have a question related to this issue.
These prefixes are not used by default in ASP.NET Core or Microsoft.Owin libraries or templates.
It is not clear if we are vulnerable if we don't use cookies with the prefix mentioned. Thanks for adding more details.