Add independent CSRF protocol test subsystem

[Copilot]

This PR adds explicit coverage for the CSRF protocol surface without coupling tests to any session backend. It validates the CSRF generic contract as a standalone unit.

• Scope

  • Introduces a dedicated test system for io.github.cl-sdk.wst.session.csrf.
  • Keeps CSRF tests independent from io.github.cl-sdk.wst.session storage implementations.

• Test subsystem wiring

  • Adds io.github.cl-sdk.wst.session.csrf.test (io.github.cl-sdk.wst.session.csrf.test.asd).
  • Registers the new subsystem in the umbrella test system (io.github.cl-sdk.wst.test.asd).

• Protocol-level CSRF coverage

  • Adds t/session-csrf-tests.lisp with a local test-csrf-context class.
  • Implements test-local methods for:
    • session-csrf-token
    • add-session-csrf-token
    • remove-session-csrf-token
    • verify-session-csrf-token
  • Covers lifecycle and replacement semantics (set/read/verify/remove, overwrite invalidates old token).

(defclass test-csrf-context ()
  ((csrf-token :initform nil :accessor test-csrf-context-token)))

(defmethod io.github.cl-sdk.wst.session.csrf:verify-session-csrf-token
    ((obj test-csrf-context) key &key &allow-other-keys)
  (let ((stored (test-csrf-context-token obj)))
    (and stored key (string= stored key))))