Fix EZP-22156: make CSRF provider optional again

This PR resolves issue https://jira.ez.no/browse/EZP-22156

CSRF provider needs to be optional because it will not be available when CSRF protection is disabled.
Needed by https://github.com/ezsystems/ezpublish-kernel/pull/665.