#93 Protect the login form and the logout against CSRF

[njoubert-cleverage]

Description

Fixes #93.

Milestone v4.0 (BC break, see below).

• CleverAgeUiProcessExtension::prepend(): enable_csrf: true on the form_login of the main firewall (token id authenticate, parameter _csrf_token: the form_login defaults, also used by the EasyAdmin login template)
• CleverAgeUiProcessExtension::prepend(): enable_csrf: true on the logout of the main firewall (token id logout, parameter _csrf_token): the logout link of the EasyAdmin user menu (LogoutUrlGenerator) carries the token, /process/logout without a valid token is refused (403)
• LoginController: passes csrf_token_intention: authenticate, so the EasyAdmin login template renders the _csrf_token hidden field
• composer.json: symfony/security-csrf declared (it was only installed as a transitive dependency)
• docs: 03-users_and_security.md (prepended configuration, CSRF requirements, logout_path()) and UPGRADE.md v4.0 (overridden login template, own logout links, opt-outs); CHANGELOG entry under BC break

Tests:

• SecurityTest::testLoginWithAnInvalidCsrfToken: the login page has the _csrf_token field; valid credentials with an invalid token are rejected (Invalid CSRF token.), the user stays logged out. testLogin still logs in with the token of the page
• SecurityTest::testLogout: logout with the link of the user menu (with the token); testLogoutWithoutCsrfToken: /process/logout without token gives a 403, the user stays logged in
• CleverAgeUiProcessExtensionTest::testPrepend: enable_csrf in the prepended form_login and logout

Checked:

• bundle (Symfony 8.1, PHP 8.5): 331 tests OK; without the fix, the login and logout tests fail. composer validate, PHPStan, PHP-CS-Fixer, Rector OK
• process-bundle-demo (Symfony 7.4, session-based CSRF tokens): login without token rejected with Invalid CSRF token., login with the token of the page redirects to the UI; /process/logout without token: 403, still logged in; logout link of the menu: logged out, redirected to the login

Requirements

• Documentation updates
  • Reference
  • Changelog
• Unit tests

Breaking changes

Applications that override the login template without the _csrf_token field, or that submit the login form without it, must add it, or set form_login.enable_csrf: false on their main firewall. Links to path('process_logout') in application templates must use logout_path() (or set logout.enable_csrf: false). See UPGRADE.md. The Symfony CSRF protection must be enabled (framework.csrf_protection, enabled by default when the session is).

🤖 Generated with Claude Code