[V2][Sessions] Make it easy/fast to use CSRF tokens with sessions (SPA & regular apps)

[LoicPoullain]

Issue

Fixes #798

Solution

The CSRF protection is managed directly by @TokenXXX and @JWTXXX.

The JWT package has two new functions: setAuthCookie and removeAuthCookie.

Breaking changes

• The configuration settings.jwt.secretOrPublicKey has been renamed to settings.jwt.secret and settings.jwt.publicKey.
• The CSRF protection does not need an additional secret anymore or to specify an expire time for the CSRF cookie.
• The @foal/csrf has been removed. CSRF defense is directly managed by the hooks @Token and @JWT.

Checklist

• Add/update/check docs (code comments and docs/ folder).
• Add/update/check tests.
• Update/check the cli generators.