Add CSRF tokens to actions rendered as POST forms

[ERuban]

Actions configured with renderAsForm() are submitted as POST requests, but the rendered <form> contains no CSRF token, so there is no way to protect these state-changing actions against CSRF attacks. The built-in delete action already ships its own token (ea-delete); this PR brings the same protection to custom actions.

Changes:

• The forms rendered by the Button component and by dropdown items with renderAsForm now include a hidden token field with a CSRF token (token ID: ea-action).
• Validation is opt-in in the action method (same approach as delete()): $this->isCsrfTokenValid('ea-action', $request->getPayload()->getString('token')). Documented in a new "Validating CSRF Tokens in Custom Actions" section.

Backward compatibility:

• The token is skipped when CSRF protection is disabled ({% guard function csrf_token %}) or when rendering outside a web request with a session (e.g. CLI/email contexts), so nothing breaks in those setups.
• The extra token field in the POST payload is harmless for existing actions that don't validate it.

Tests: component-level rendering tests (token present with a session, absent without a request), assertions in the existing renderAsForm() functional tests, and an end-to-end test with a CSRF-validating action in the test app (empty/invalid token → 400 and no side effect, valid token → action executed).