CSRF token cookie could be improved

*This issue was originally created by [**@reivilibre**](https://github.com/reivilibre) at .*

I was just looking at the code for the CSRF token cookie and suspect it could be improved.

https://github.com/matrix-org/matrix-authentication-service/blob/7c67630c951ecf2fc8e19a8184ca51ba2476a03c/crates/axum-utils/src/csrf.rs#L134

* cookie name should start with `__Host-` to prevent, in modern browsers that support this, some classes of cookie fixation attacks.
* making it HTTP-only and 'Secure' seems good as defence in depth

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

I think localhost is considered 'Secure' so this shouldn't affect local development much, but there is a minor possibility this would need to be configurable.