[FrameworkBundle] Only enable CSRF protection when enabled in config

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | maybe?
| Deprecations? | no
| Tests pass?   | I hope, master was already broken here
| License       | MIT

https://github.com/symfony/symfony/commit/bf85e8365ab8aec8799c8207f32598ab09d95183 introduced new service configuration for CSRF protection in the frameworkbundle. It is always enabled even if you don't use it. Since it also depends on enabling the session that's not so nice.