Deduplicate middleware Set-Cookie headers by cookie identity

[RajvardhanPatil07]

What changed

This updates the middleware cookie merge path so later Set-Cookie values replace matching middleware cookies by cookie identity: name, domain, and path.

That means when middleware sets a cookie and a later Server Action sets the same cookie, the final response only includes the later value instead of sending duplicate Set-Cookie headers for the same cookie.

Why

Fixes #69785.

Middleware cookies are stored on request metadata and later merged into response Set-Cookie headers. The previous merge only deduped exact string matches, so values like session=from-middleware; Path=/ and session=from-action; Path=/ both survived even though the latter should take precedence.

Notes

The identity-based merge is only applied when middleware cookies are present. Non-middleware Set-Cookie behavior is preserved, including multiple same-name cookies set by other response paths.

Validation

• pnpm testonly packages/next/src/server/lib/patch-set-header.test.ts --runInBand
• pnpm prettier --check packages/next/src/server/lib/patch-set-header.ts packages/next/src/server/lib/patch-set-header.test.ts packages/next/src/server/web/spec-extension/cookies.ts
• pnpm --filter next build