Exempt XML-RPC from CSRF

Currently we couldn't exempt XML-RPC from CSRF without exempting the entirety of ``warehouse.legacy.pypi:pypi``. Instead of doing that we create a middleware that allows us to rewrite URLs for the legacy PyPI stuff into unique URLs which can then be used in the normal Werkzeug dispatcher.

This made it trivial to exempt XML-RPC from CSRF.