docs: add explanation about redirect and Cookies/Headers

[kenjis]

Description

• add explanation about redirect and Cookies/Headers

Checklist:

• Securely signed commits
• [] Component(s) with PHPDoc blocks, only if necessary or adds value
• [] Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[kenjis]

This is the current behavior,
but what would be the issues if we automatically copy them to RedirectResponse?

[MGatner]

It seems like a possible security concern to pass forward all cookies & headers blindly. Because any library can force a redirect with RedirectException I think it is better to require explicit forwarding of those attributes.

[michalsn]

This is the current behavior,
but what would be the issues if we automatically copy them to RedirectResponse?

There might be even simple issues with the flow. User can set a cookie but then decide not to include it when some sort of error occur and a redirect + error message is needed.

[kenjis]

Yes, there is a valid point in explicit forwarding.
But it seems not easy to understand the behavior like #8163
In CI3 or pure PHP, setting cookies is global.