Fix cookie samesite issue for LTI 1.3 deep linking

gems/canvas_breach_mitigation/lib/canvas_breach_mitigation/masking_secrets.rb

@@ -32,7 +32,7 @@ def masked_authenticity_token(cookies, options = {})
         encoded_masked_token = masked_token(unmasked_token(cookies["_csrf_token"]))
 
         cookie = { value: encoded_masked_token }
-        %i[domain httponly secure].each do |key|
+        %i[domain httponly secure same_site].each do |key|
           next unless options.key?(key)
 
           cookie[key] = options[key]

gems/request_context/lib/request_context/session.rb

@@ -32,7 +32,8 @@ def call(env)
         ActionDispatch::Request.new(env).cookie_jar[:log_session_id] = {
           value: session_id,
           secure: Rails.application.config.session_options[:secure],
-          httponly: true
+          httponly: true,
+          same_site: Rails.application.config.session_options[:same_site]
         }
       end
 

lib/canvas/request_forgery_protection.rb

@@ -40,7 +40,7 @@ def verified_request?
 
     def authenticity_token_options
       session_options = CanvasRails::Application.config.session_options
-      options = session_options.slice(:domain, :secure)
+      options = session_options.slice(:domain, :secure, :same_site)
       options[:httponly] = HostUrl.is_file_host?(request.host_with_port)
       options
     end