fix(auth): Fix CSRF token refresh for multi-tab auth scenarios

[JoshFerge]

Summary

• Moves the CSRF token cross-tab synchronization from organization-login.html to the base auth.html template
• Synchronization logic now uses csrfEls.length > 0 and loops through ALL CSRF elements instead of only one.

Problem

Users experience "CSRF token from POST incorrect" errors when:

1. They have multiple tabs open on auth pages
2. One tab completes login (rotating the CSRF token)
3. Other tabs try to submit with stale CSRF tokens

The original cross-tab synchronization was introduced in #32592, but it only worked when there was exactly 1 CSRF form (SSO auth orgs). This PR also fixes it to work on orgs without SSO, where there are multiple login forms (login + register) with multiple tokens.

Solution

Move the cross-tab synchronization to the base auth.html template so ALL auth pages benefit:

• login.html
• twofactor.html
• twofactor_u2f.html
• organization-login.html
• oauth-authorize.html
• oauth-device.html
• And other auth templates

Test plan

1. Open two tabs to /auth/login/sentry/
2. In browser console on both tabs, check CSRF values: document.getElementsByName('csrfmiddlewaretoken')[0].value
3. Log in on Tab 1
4. Check Tab 2 - the CSRF values should update within 200ms
5. Submitting on Tab 2 should succeed (no CSRF error)

Known limitation

WebAuthn/passkey auto-submit (form.submit()) may still race ahead of the 200ms interval. This is a narrower edge case. If we still observe problems, we can likely lower the interval.

Monitoring:

we can use this logs query to observe if the number of users hitting this error decreases after the change.

Can monitor as we rollout to confirm changes don't degrade auth, during my local testing all looks good.

[JoshFerge]

this just load our tags library so it adds nonce on the javascript we're adding, most of the relevant pages this inherits from already load it anyways.

[cathteng]

I think is this fine but I asked Cursor if there were other HTML forms that this doesn't cover and moving the logic to modal.html would cover all forms (e.g. organization-auth-provider-settings.html)

[JoshFerge]

I think is this fine but I asked Cursor if there were other HTML forms that this doesn't cover and moving the logic to modal.html would cover all forms (e.g. organization-auth-provider-settings.html)

do you know if this problem happens for non-login forms as well?