Use :hybrid mode cookie serialisation
Use :hybrid mode cookie serialisation

This accepts :json and :marshal cookies, and produces :json cookies.
Brakeman wants us to use :json and not :marshal or :hybrid, but
switching straight to :json from :marshal breaks existing sessions.

We'll have to override brakeman for this PR, as it will still fail.
But a little time in the future we can change to :json cookies.

alphagov/specialist-publisher-rebuild,alphagov/specialist-publisher,alphagov/specialist-publisher,alphagov/specialist-publisher-rebuild,alphagov/specialist-publisher-rebuild,alphagov/specialist-publisher,alphagov/specialist-publisher-rebuild