_csrf_token is broken due to cacheability metadata integration, results in rendered links without valid CSRF tokens

Problem/Motivation

Let's assume we have the following routing definition:

features.export_download:
  path: '/admin/config/development/configuration/features/download/{uri}'
  defaults:
    _controller: 'Drupal\features\Controller\FeaturesController::downloadExport'
  requirements:
    _permission: 'export configuration'
    _csrf_token: 'TRUE'

And the following code in a form submit function:

  public function exportFormSubmit(array &$form, FormStateInterface $form_state) {
    // Redirect to the archive file download.
    $form_state->setRedirect('features.export_download', ['uri' => $this->archiveName]);
  }

Result: The token has the sha1 hash, not the actual CSRF token

Proposed resolution

• Apply the CSRF token replacement in \Drupal\Core\Form\FormSubmitter::redirectForm (sounds wrong)
• Provide a way to generate the URL with the CSRF token (seems impossible at the moment, we always pass along GeneratedUrl)

Remaining tasks

User interface changes

API changes

Data model changes