Add CSRF protection for /user/logout

Thanks for the report. Working on this today.

CSRF protection and tests confirming have been added to the logout route.

I think we create a follow up issue to introduce the _csrf_confirm_form_route that mimics the OpenIDConnectRedirectController::redirectLogout. That seemed like a bigger refactor and likely warrants a separate issue.