Fix CSRF spelling inconsistency

Being named Cross-Site Request Forgery (note the dash) is not consistent with Cross Site Scripting and the URL naming scheme at http://brakemanscanner.org/docs/warning_types/

Currently, CSRF warnings in an HTML report link to this broken URL: http://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/