"Why isn't there a header that web servers can give out to browsers basically saying "Don't use the cookie/session I'm giving you ever, unless you're literally on this site"?"

There is, it's relatively new though:

https://blog.mozilla.org/security/2018/04/24/same-site-cooki...