Add CSRF protection

### What feature do you want to see added?

Add CSRF protection to improve security.

### Why do you want this feature? Does it solve a problem?

Websites that rely on cookie-based authentication may be vulnerable to cross-site request forgery (CSRF). Specifically, a state-changing request should include a secret token so the request can't be forged by an attacker. Otherwise, unwanted requests can be submitted on behalf of a user who visits a malicious website.

This is typically mitigated by embedding a session-specific secret token in each request. This token is then checked as an additional authentication measure. A malicious website should have no way of guessing the correct token to embed in the request.

### How should the feature be implemented?

Could use a middleware package such as lusca.csrf to protect against CSRF attacks.

### Additional context (if applicable)

See https://github.com/Capgemini/gov-prototype-by-prompt/security/code-scanning/31 for more details.

No files or tests are named. Start by reviewing the Express request handling and the linked security report, then assess the proposed lusca.csrf middleware. Done should mean state-changing requests using cookie-based authentication require a valid session-specific token.

Written by the indexing model from the issue text.