[6.x] Convert Responsables to Response objects in VerifyCsrfToken

[sebastiandedeyne]

When VerifyCsrfToken tries to add cookies to a Responsable object, it triggers an error that the headers property is undefined.

The underlying problem is that if the Responsable hasn't been transformed to a response yet, the $headers doesn't necessarily exist.

This PR adds an instanceof check to the $response variable. If it's a Responsable, it will transform it to a Response object first.

Closes #29845

[driesvints]

@sebastiandedeyne you might want to add an explanation why this is needed instead of linking to an issue. Otherwise your pr will probably be closed.

[sebastiandedeyne]

Sorry, updated the description!