fix(types): stricter types for unsigned cookies

[ojeytonwilliams]

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

This PR narrows the return type of unsign to better reflect the Signer logic. Specifically, that if unsigning fails the renew property will be false and value will be null, but if it succeeds renew can be boolean, but value can only be a string, never null.

This is consistent with the logic in the default Signer, but it does mean that custom Signers have to use the same high-level logic.

[mcollina]

lgtm