support user configuration of auth cookie max age

Signed-off-by: Jessica He <jhe@redhat.com>

docs/auth/okta/provider.md

@@ -45,6 +45,8 @@ auth:
         audience: ${AUTH_OKTA_DOMAIN}
         authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional
         idp: ${AUTH_OKTA_IDP} # Optional
+        ## uncomment to set lifespan of user session
+        # sessionDuration: { hours: 24 } # Optional: supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
         # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned
         additionalScopes: ${AUTH_OKTA_ADDITIONAL_SCOPES} # Optional
         signIn:
@@ -62,6 +64,7 @@ The values referenced are found on the Application page on your Okta site.
   `https://company.okta.com`
 - `authServerId`: The authorization server ID for the Application
 - `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3`
+- `sessionDuration`: Lifespan of the user session.
 
 `additionalScopes` is an optional value, a string of space separated scopes, that will be combined with the default `scope` value of `openid profile email offline_access` to adjust the `scope` sent to Okta during OAuth. This will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, setting the `additionalScopes` value to `groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app.