Fix issue where required cookies are removed by orejime

[artlowel]

References

• Fixes Language selection is not retained after page refresh #4133
• Fixes Logout on browser reload (dsAuthInfo cookie is lost) #3963

Description

This issue was caused by some unintuitive behavior of the orejime cookie popup. If apps are required, their cookies are still automatically deleted before the user has clicked "accept" or "decline" in the popup. And in the case where you don't have optional cookies that popup is never shown, so as a result all required cookies keep being deleted every time you refresh the page.

The solution was to set optOut: true for all required apps. This means that the cookies will be assumed to be allowed unless the user turns them off. Since they're required as well, the user can't turn them off. You'd expect optOut to be implied by the required option. But it seems like it isn't.

Instructions for Reviewers

• Ensure changes to the language are persisted after you reload the page manually.
• Test this both with, and without optional cookies. E.g. you can add a bogus google analytics key to your backend config, to have an optional cookie
• If you have no optional cookies you shouldn't see the popup at all
• if have have optional cookies the language should persist after a reload both before and after you've accepted or declined the popup

Checklist

• My PR is created against the main branch of code (unless it is a backport or is fixing an issue specific to an older branch).
• My PR is small in size (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
• My PR passes ESLint validation using npm run lint
• My PR doesn't introduce circular dependencies (verified via npm run check-circ-deps)
• My PR includes TypeDoc comments for all new (or modified) public methods and classes. It also includes TypeDoc for large or complex private methods.
• My PR passes all specs/tests and includes new/updated specs or tests based on the Code Testing Guide.
• My PR aligns with Accessibility guidelines if it makes changes to the user interface.
• My PR uses i18n (internationalization) keys instead of hardcoded English text, to allow for translations.
• My PR includes details on how to test it. I've provided clear instructions to reviewers on how to successfully test this fix or feature.
• If my PR includes new libraries/dependencies (in package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.
• If my PR includes new features or configurations, I've provided basic technical documentation in the PR itself.
• If my PR fixes an issue ticket, I've linked them together.

[tdonohue]

Thanks @artlowel ! I'm going to review this today. Based on the description though, this might also fix #3963 . I'll check that too when I test this.

[tdonohue]

👍 Thanks @artlowel ! I've tested this today and verified it fixes both #4133 and also #3963 (which seems to have had the same underlying cause, but for the authentication cookie). Neither of these can be reproduced with this PR installed.

Glad you discovered this was simply a misconfiguration of Orejime.