feat(batch): keep cookies between steps

[yusukebe]

Batch now keeps the cookies a response sets and sends them on the next steps, like a browser. So "log in, then post" works in one batch. Before, an agent could not check a login flow with batch: in a trial, the grading agent forged a session cookie from the secret in .dev.vars instead. A cookie header in a step wins, and Max-Age=0 removes a cookie.

The author should do the following, if applicable

• Add tests
• Run tests
• pnpm run format:fix && pnpm run lint:fix to format the code
• Add TSDoc/JSDoc to document the code