v4.9.0

• Introduces Cookie and SameSite public APIs and internal validation/value objects for RFC-oriented cookie name/value constraints.
• Updates internal response header aggregation to preserve multiple header values (enabling multiple Set-Cookie headers) and adds tests around case-insensitive header operations.
• Documents cookie usage patterns in the README and adds dedicated PHPUnit coverage for cookie serialization and invariants.