How do I modify the "has_js" cookie?
The has_js cookie is set, to indicate JavaScript is enabled, in drupal.js with the following code.

// 'js enabled' cookie.
document.cookie = 'has_js=1; path=/';


The HttpOnly flag makes the cookie not available from JavaScript.
For that reason, it's not possible to set the HttpOnly flag when creating a cookie from JavaScript. It may cause issues if there is code that checks for that cookie to determine if JavaScript or cookie support is enabled.

The Secure flag is used to make the cookie only available over HTTPS, which may cause issues with checking for JavaScript support on non HTTPS pages. Nevertheless, if your site is fully HTTPS, that should be fine.

With that being said, you could look into setting the HttpOnly flag on the has_js cookie server side, by checking for that cookie and updating it to use the HttpOnly flag via setcookie().