Add Session based CSRF Protection

[kenjis]

Description

Cross-Site Request Forgery Prevention Cheat Sheet says,

In short, the following principles should be followed to defend against CSRF:
...
For stateful software use the synchronizer token pattern
For stateless software use double submit cookies

Now CI4 has only "double submit cookies".
This PR adds "synchronizer token pattern".

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide