docs: security.txt: Update the CSRF section

Make it reflect the current reality. These changes were made in the
fcgi_app_core code base, see the following commits there for details.

975e5a3 ("app: utils: generate_hash: Reduce the amount of entropy used")
8170a3e ("app: url_helpers: Switch the session id and csrf token to
SHA1's")

Signed-off-by: Andrew Clayton <andrew@dnsandmx.com>