Allow cookie token reading without cookie auth mode

[sdelamo]

Fixes #962

Summary

• enable access-token cookie reader/configuration when micronaut.security.token.cookie.enabled=true is explicitly set
• keep cookie login/logout handlers and refresh-cookie surfaces gated by the existing cookie/idtoken authentication mode
• document the independent cookie token reader opt-in

Validation

• ./gradlew :micronaut-security:compileJava :micronaut-security-jwt:test --tests io.micronaut.security.token.jwt.cookie.CookieEnabledSpec --no-daemon
• ./gradlew :micronaut-security:checkstyleMain --no-daemon (build successful; existing generated descriptor Javadoc warning remains)

Release Metadata

• Target branch: 5.1.x
• Target release: 5.1.0
• Micronaut organization project: 5.1.0 Release

---

✨ This message was AI-generated using gpt-5.5

[Copilot]

Pull request overview

This PR decouples access-token cookie reading from the Cookie/IDToken authentication mode, allowing services to opt-in to cookie token consumption via configuration without also enabling cookie login/logout handlers.

Changes:

• Introduces a new TokenCookieEnabledCondition that enables cookie token reading when either cookie/idtoken auth mode is active or micronaut.security.token.cookie.enabled=true is explicitly set.
• Updates CookieTokenReader and TokenCookieConfigurationProperties to use the new condition instead of CookieBasedAuthenticationModeCondition.
• Documents the independent opt-in and adds test coverage verifying the reader/configuration can load without cookie auth mode while login/logout handlers remain disabled.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/main/docs/guide/securityFilter/builtInAuthenticationFetchers/tokenAuthenticationFetcher/tokenReaders/cookieTokenReader.adoc	Documents explicit opt-in for cookie token reading independent of cookie auth mode.
src/main/docs/guide/authenticationStrategies/jwt/reader/cookieToken.adoc	Adds documentation noting micronaut.security.token.cookie.enabled=true enables reading without cookie login/logout handlers.
security/src/main/java/io/micronaut/security/token/cookie/TokenCookieEnabledCondition.java	Adds a condition to gate cookie token reading by cookie auth mode or explicit enablement.
security/src/main/java/io/micronaut/security/token/cookie/TokenCookieConfigurationProperties.java	Switches config properties bean gating to the new condition.
security/src/main/java/io/micronaut/security/token/cookie/CookieTokenReader.java	Switches token reader bean gating to the new condition.
security-jwt/src/test/groovy/io/micronaut/security/token/jwt/cookie/CookieEnabledSpec.groovy	Adds tests for explicit opt-in without cookie auth mode and ensures login/logout handlers remain disabled.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud