This fixes vouch#348

The problem: When a user visits a protected URL that is very long
(e.g., a Grafana explore URL with a complex query), the session
cookie exceeds the securecookie MaxLength of 4096 bytes, causing
a "securecookie: the value is too long" error. This breaks the
OAuth flow - the session isn't saved, so when the OAuth callback
returns, the state validation fails with "Invalid session state".

The solution: Implement a MultiPartCookieStore that:
1. Removes the securecookie MaxLength limit (we handle size ourselves)
2. Automatically splits large session cookies into multiple parts
   (e.g., VouchSession_1of3, VouchSession_2of3, VouchSession_3of3)
3. Reassembles the parts when reading the session back

This approach mirrors how Vouch already handles large JWT cookies
in pkg/cookie/cookie.go.

The change is backwards compatible - existing session cookies will
continue to work because:
- The store first tries to read a single cookie before looking for parts
- The same securecookie encoding is used
- Small sessions are still written as single cookies

Dockerfile: Updated Go from 1.23 to 1.24, required by dependencies
(golang.org/x/net requires go >= 1.24.0).