Filter browser-extension cookies from detection

Cookies set by browser extensions are not the website operator's
compliance responsibility. This adds stack-trace inspection to
filter out extension-originated document.cookie writes, and
annotates pre-existing cookies with a source field so operators
can triage them separately.

Introduces a CookieSource enum (SCRIPT / PRE_EXISTING) across
the full stack: PostgreSQL, coredata, service, HTTP handler, and
GraphQL schema. On conflict, source is upgraded from PRE_EXISTING
to SCRIPT when a page script is later observed setting the cookie.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/console/v1/graphql/cookie_banner.graphql

@@ -22,6 +22,18 @@ enum CookieConsentMode
         )
 }
 
+enum CookieSource
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.CookieSource") {
+    SCRIPT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CookieSourceScript"
+        )
+    PRE_EXISTING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CookieSourcePreExisting"
+        )
+}
+
 enum CookieBannerOrderField
     @goModel(
         model: "go.probo.inc/probo/pkg/coredata.CookieBannerOrderField"
@@ -174,6 +186,7 @@ type Cookie implements Node {
     name: String!
     duration: String!
     description: String!
+    source: CookieSource!
     createdAt: Datetime!
     updatedAt: Datetime!
 

pkg/server/api/console/v1/types/cookie.go

@@ -72,6 +72,7 @@ func NewCookie(c *coredata.Cookie) *Cookie {
 		Name:        c.Name,
 		Duration:    c.Duration,
 		Description: c.Description,
+		Source:      c.Source,
 		CreatedAt:   c.CreatedAt,
 		UpdatedAt:   c.UpdatedAt,
 	}