Reassemble ArgoCD's chunked session-token cookie

[jenting]

Problem

ArgoCD's server splits a session token whose value exceeds the browser's ~4093-byte per-cookie limit across multiple cookies:

• the base argocd.token cookie holds <chunkCount>:<chunk0>
• the remaining chunks live in argocd.token-1, argocd.token-2, …

This is common for SSO users who carry many group claims.

extractToken previously read only the base argocd.token cookie. For these users the value was the truncated <count>:<chunk0> fragment, so JWT verification failed and the request silently fell back to proxying to the backend — losing the cached list-applications fast path for exactly the heaviest users (large group lists also mean the RBAC filtering matters most).

Change

Reconstruct the full token from all chunks in joinChunkedToken, mirroring ArgoCD's own util/http.JoinCookies, so the proxy verifies exactly the token the backend would.

• A token that fits in one cookie (no <count>: prefix) is returned unchanged.
• Chunks are reassembled by index regardless of cookie ordering.
• A malformed or absent token cookie yields an empty token, so the request falls back to proxying unchanged (same safe behavior as before).
• The Authorization: Bearer header still takes precedence over cookies.

Tests

Extended TestExtractToken with cases for multi-chunk reassembly, out-of-order cookies, header precedence over chunked cookies, and malformed chunk counts. Full suite and go vet pass.