we can be smart and just derive the cookie domain (which is the most
specific available shared subdomain of the api and frontend) by parsing
the api host name and frontend host name and working out the subdomain
hierarchy there.

This has the advantage of us not needing to thing about domain structure
when setting up the configuration - rather we can just pass in the full
hostnames of the apps, which we're more likely to have available rather
than the nebulous concept of a shared domain which varies wildly based
on running locally vs on paas/on ecs.

This function splits the host name by dot, (so
download.documents.service.gov.uk becomes ["uk", "gov", "service",
"documents", "download"]) and then loops through both api and frontend
at the same time.

note that patching os environ is pretty tough because it's read at
import time by config, so just patch the values on the config object
itself

it's got the same function as the frontend hostname, but is only used on
dev.

note this needs a matching change to notifications-local