Implement CSRF protection

[awidener3]

Include CSRF protection in Roosevelt applications

• CSRF protection is enabled by default.
• CSRF can only be fully disabled by disabling express-session (added with Add express-session dependency #1341).
• Developers can switch between full (default) and manual. manual allows the dev to specify which routes are protected.
• The README has been updated to educate devs on how to include a CSRF token in their POST requests.

closes #27

closes #1244

[awidener3]

@kethinov I'm not 100% sold on my decision of using full vs. manual as configuration options. Any suggestions or thoughts?

[codecov]

Codecov Report

Attention: Patch coverage is 28.00000% with 144 lines in your changes are missing coverage. Please review.

Project coverage is 83.44%. Comparing base (b4c5091) to head (d89f43c).

Files	Patch %	Lines
lib/setExpressConfigs.js	14.51%	53 Missing ⚠️
lib/scripts/certsGenerator.js	0.00%	45 Missing ⚠️
lib/scripts/csrfSecretGenerator.js	13.33%	39 Missing ⚠️
roosevelt.js	50.00%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1351      +/-   ##
==========================================
- Coverage   87.32%   83.44%   -3.88%     
==========================================
  Files          25       26       +1     
  Lines        3590     3758     +168     
==========================================
+ Hits         3135     3136       +1     
- Misses        455      622     +167     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.