feat(gpclient): add --cookie-only to print gateway cookie without starting tunnel

[maksym-shaiev]

feat(gpclient): add --cookie-only to print gateway cookie without starting tunnel

Summary

Adds --cookie-only to gpclient connect. When set, the command authenticates
fully (including CAS/SAML, --cookie-cache reuse) then prints the gateway
authcookie to stdout and exits — without opening a tun device, without issuing
logout, and without requiring root.

Motivation

There is currently no way to obtain a verified gateway authcookie from gpclient
without also starting the VPN tunnel (which requires root). External integrations
that need the cookie but want to manage the tunnel themselves — NetworkManager
plugins, systemd scripts, CI pipelines — have no clean path.

The existing gpauth | gpclient --cookie-on-stdin pattern produces a portal
SamlAuthResult (pre-gateway-login). What external integrations need is a
gateway authcookie (post-gateway-login, ready for openconnect --cookie-on-stdin).
--cookie-only fills that gap.

Output format

Matches openconnect --authenticate for easy shell consumption and eval safety:

COOKIE='authcookie=…&portal=…&user=…&computer=…'
HOST='gateway.example.com'

Relation to existing flags

Flag	Input/Output	Level
--cookie-on-stdin	reads JSON SamlAuthResult	portal (pre-gateway-login)
--cookie-only	writes gateway authcookie	gateway (post-gateway-login)

Together they cover both directions of external integration.

Properties

• No tun device allocated → no root required
• No logout.esp issued → cookie stays valid for the caller
• Covers all three call sites in connect_gateway(): cached portal cookie,
  portal fallback, and gateway prelogin paths

Usage examples

Feed directly to openconnect:

eval "$(gpclient connect portal.example.com \
    --browser --cookie-cache --cookie-only)"
printf '%s\n' "$COOKIE" | \
    sudo openconnect --protocol=gp --cookie-on-stdin portal.example.com

Unprivileged auth + privileged tunnel (split across users/processes):

# As normal user — no root required
RESULT=$(gpclient connect portal.example.com \
    --browser chrome \
    --cookie-cache ~/.config/gpclient/cookie.json \
    --cookie-only)

# As root / NM service — consume the cookie
printf '%s\n' "$(echo "$RESULT" | grep '^COOKIE=' | cut -d= -f2-)" | \
    openconnect --protocol=gp --cookie-on-stdin portal.example.com

Combined with --cookie-cache for session reuse (browser only opens when
the portal session has expired):

gpclient connect portal.example.com \
    --browser chrome \
    --cookie-cache \
    --cookie-only

Changes

• apps/gpclient/src/connect/args.rs — add cookie_only: bool field with
  --cookie-only clap argument; add 2 tests
• apps/gpclient/src/connect/gateway.rs — early-return block at top of
  connect_gateway() covering all call sites

Testing

cargo test -p gpclient --no-default-features -- connect::args

17 tests pass including the two new ones:

• cookie_only_flag_parses — verifies --cookie-only is accepted by clap
• cookie_only_is_disabled_by_default — verifies the flag defaults to false