spec: Update recommendations for DBUS_COOKIE_SHA1 timeouts

This had two issues that could damage interoperability.

First, the spec wording suggested that any cookie that had not been
deleted was suitable for use in authentication. However, this introduces
a race condition, which is called out in comments in both the reference
implementation and GDBus: the newest cookie might be less old than the
arbitrary lifetime when authentication *begins*, but older than the
lifetime at the time authentication *ends*. As a result, we need a grace
period during which an old cookie will still be accepted, but a newer
cookie exists and will be used for new authentication operations.

Second, the spec wording implied that the arbitrary timeouts were
completely up to the implementor. However, GLib bug
https://gitlab.gnome.org/GNOME/glib/-/issues/2164 indicates that they
need to be reasonably compatible: in particular, GDBus servers
historically didn't allocate new cookies until 10 minutes had passed,
but libdbus clients would decline to use a cookie older than 5 minutes,
causing authentication to fail if the gdbus-server test-case (in which
GDBus and libdbus clients connect to a GDBus server) happened to take
longer than 5 minutes to run.

While I'm here, also be consistent about calling the secrets "cookies"
(consistent with the name of the mechanism) rather than "keys" (which
is what they are called in libdbus' dbus-keyring.c).

Signed-off-by: Simon McVittie <smcv@collabora.com>
11 jobs for spec-cookie-timeouts in 8 minutes and 56 seconds (queued for 3 seconds)
Status Job ID Name Coverage
  Build
passed #4434328
build:cmake

00:03:59

passed #4434325
build:debug

00:08:56

manual #4434330
allowed to fail manual
build:i686-w64-mingw32-cmake
passed #4434329
build:i686-w64-mingw32-debug

00:05:12

manual #4434327
allowed to fail manual
build:legacy
passed #4434324
build:production

00:05:36

manual #4434326
allowed to fail manual
build:reduced
manual #4434333
allowed to fail manual
build:stretch
passed #4434331
build:x86_64-w64-mingw32

00:04:34

passed #4434332
build:x86_64-w64-mingw32-cmake-debug

00:07:36

manual #4434334
allowed to fail manual
build:xenial