docs/security.txt: Use a SHA-1 hash in the csrf token example

CSRF tokens are now SHA-1 hashes rather than SHA-256 hahses.

Signed-off-by: Andrew Clayton <andrew@digital-domain.net>