fix(router)!: block all cross-site unsafe requests when using PreventCrossSiteRequestsMiddleware

[innocenzi]

I initially implemented this with the idea that Tempest defaults to using LAX cookies, so sessions are not carried during cross-site POST requests.

However, it's better to special-case the routes that need support for this instead of it being allowed by default, so this PR changes that.

Marking as breaking because technically it is, payment provider flows might be affected and related routes will need to get hand-rolled protection.

[github-actions]

Benchmark Results

Comparison of fix/cross-site-unsafe-requests against 3.x (a919dec4b485a217888badd16ee5b5b307a1cf53).

Open to see the benchmark results

Benchmark	Set	Mem. Peak	Time	Variability
ViewRenderBench(benchPlainHtml)	-	21.987mb 0.00%	483.843μs +8.58%	±1.25% -10.49%

_{Generated by phpbench against commit 1a5eb1a}

[brendt]

Thanks to @edorian for flagging this