Title: OAuth2 filter sets the tokens in the cookies but not encrypted

Description:

I am using the Oauth2 filter with OIDC scopes to authenticate my web application's users. It sets the access_token, refresh_token, and id_token as the cookies and these tokens are not encrypted. The cookies are also not marked as http_only.
Most of the Oauth clients encrypt the tokens when using cookies as storage. i.e. NextAuth etc.
The Oauth2 filter must support this. If not, please provide the reasons and the alternate solution to encrypt the tokens.
I think most of the SecOps will not allow using the oauth2 filter in the production without this feature.

[optional Relevant Links:]

https://next-auth.js.org/configuration/options#secret