`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation

The publication date reported by the vendor.

We collected the advisory from the official source.

Our collector saw this advisory during a later source check.