Fix Max-Age precedence when expiring session cookies

[Alex0AI]

Problem

get_expired_cookies() gives Expires priority over Max-Age. RFC 6265 section 4.1.2.2 specifies the reverse: https://www.rfc-editor.org/rfc/rfc6265.html#section-4.1.2.2

A response such as Set-Cookie: cookie2=bar; Max-Age=3600; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Path=/ is accepted by Requests, but HTTPie's extra expiration pass then removes the valid cookie from the persisted session. The next request loses cookie2=bar. Conversely, Max-Age=0 combined with a future Expires does not mark a cookie for removal.

Change

Let the existing valid Max-Age conversion override Expires. Invalid Max-Age values still fall back to Expires. Update the malformed-Expires regression: a valid Max-Age remains authoritative even when the date is malformed.

This is separate from #1914's signed Max-Age parsing; the current digit-only parsing is unchanged.

Verification

• New local-server integration test verifies that the cookie survives session persistence and is sent on the next request.
• Five parameterized cases cover both priority directions, a malformed date, and invalid Max-Age fallbacks.
• Before the fix: 4 failed, 2 passed in the new regressions.
• After the fix: python -m pytest tests/test_sessions.py tests/test_cookie.py -q -o addopts='': 68 passed (existing resource/deprecation warnings).
• python -m flake8 httpie/utils.py tests/test_sessions.py and git diff --check passed.

AI assistance disclosure: OpenAI Codex investigated, implemented, tested, and drafted this PR description.