[9.x] Allow VerifyCsrfToken's CSRF cookie to be extended

[jaggy]

This PR moves how the CSRF token is created to its own method.

Why?

There are some cases in multi-tenant systems that the user might want to change the CSRF token name to prevent 419 errors. Multiple Auth providers make this happen as well mainly in XHR requests. This also allows multi-tenant systems to update the token's domain (ie, pull the current tenant's custom domain) from the middleware layer.

I think this is going to help a lot with people using Inertia to allow customization in how XSRF-TOKEN is named by adding the tenant ID, or even the user type.

By allowing the cookie to be extended in user-land, the user can create 2 different VerifyCsrfToken classes and allow it to be modified without having to extend the whole addCookieToResponse method.

class VerifyCsrfToken extends Middleware {
    protected function newCookie($request, $config)
    {
        return new Cookie(
            "XSRF-TOKEN-{$request->user()->type}",
            $request->session()->token(),
            $this->availableAt(60 * $config['lifetime']),
            $config['path'],
            $config['domain'],
            $config['secure'],
            false,
            false,
            $config['same_site'] ?? null,
        );
    }
}

[thugic]

Why not just passing the request, since the only usage of the method is this one, you could just get the config in there, if missing? (Then you could remove src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php:185)

Suggested change

	protected function newCookie($request, $config)
	{
	return new Cookie(
	'XSRF-TOKEN', $request->session()->token(), $this->availableAt(60 * $config['lifetime']),
	$config['path'], $config['domain'], $config['secure'], false, false, $config['same_site'] ?? null
	);
	}
	protected function newCookie($request, $config = null)
	{
	$config = $config ?: config('session');
	return new Cookie(
	'XSRF-TOKEN', $request->session()->token(), $this->availableAt(60 * $config['lifetime']),
	$config['path'], $config['domain'], $config['secure'], false, false, $config['same_site'] ?? null
	);
	}