Remove `yiisoft/cookies` dependency

[vjik]

The package uses only a tiny part of yiisoft/cookies — building a single Set-Cookie header in CookieLogin. It would be nice to drop it.

[klsoft-web]

Getting rid of the unnecessary dependencies is a good idea. I think we can remove yiisoft/cookies, along with CookieLogin, CookieLoginIdentityInterface and CookieLoginMiddleware, and put them in a separate package called yiisoft/cookie-login.
The new package, yiisoft/cookie-login, will depend on the yiisoft/user and yiisoft/cookies packages.
This will reduce the dependencies for the yiisoft/user package.

[vjik]

Getting rid of the unnecessary dependencies is a good idea. I think we can remove yiisoft/cookies, along with CookieLogin, CookieLoginIdentityInterface and CookieLoginMiddleware, and put them in a separate package called yiisoft/cookie-login.
The new package, yiisoft/cookie-login, will depend on the yiisoft/user and yiisoft/cookies packages.
This will reduce the dependencies for the yiisoft/user package.

We can leave CookieLogin, CookieLoginIdentityInterface and CookieLoginMiddleware in yiisoft/user, just implement it without yiisoft/cookies usage.

[klsoft-web]

If we implement these classes without using the yiisoft/cookies package, we will end up writing new code to achieve the same result, rather than making use of existing code within the package.
The yiisoft/session package also uses "a tiny part" of the yiisoft/cookies package. If so, should we remove the yiisoft/cookies package from the yiisoft/session package too?

[vjik]

If so, should we remove the yiisoft/cookies package from the yiisoft/session package too?

No. We use contract SessionInterface, therefore, I would keep the yiisoft/session dependency.

[klsoft-web]

The package uses only a tiny part of yiisoft/cookies — building a single Set-Cookie header in CookieLogin. It would be nice to drop it.

I used the yiisoft/session package as an example of one that also uses "a tiny part" of the yiisoft/cookies package.
What criterion should we use to decide whether a part is "tiny" enough to justify removing the yiisoft/cookies package?