Move avoidance of setting deleted cookies into WebResponse

Move avoidance of setting deleted cookies into WebResponse

There's no reason this should be only in CookieSessionProvider when
we're already handling deduplication in WebResponse.

Further, this fixes the bug in the existing CookieSessionProvider
implementation that a setCookie() followed by a clearCookie() wouldn't
actually clear the cookie.

This reverts commit 1ce684fcef1ee69ca0921c05081cae47f90939e5.

Bug: T124252
Change-Id: I1098d054facacd59f03ebed7c747ec9ff6bf66e7
Depends-On: I61d14bf80fa7c857dec9cffb366dc3f84dbb4faf