docs: security.txt: Update the CSRF section

Make this reflect the current reality caused by the following commits:

975e5a3 ("app: utils: generate_hash: Reduce the amount of entropy used")
8170a3e ("app: url_helpers: Switch the session id and csrf token to
SHA1's")

Signed-off-by: Andrew Clayton <andrew@digital-domain.net>