Fixes #21495: Adds CSRF header name setting and moves CSRF settings to CSRF View Middleware.

This allows for the View Middleware to be subclassed to swap out any applicable settings. This currently pulls in the available settings from the settings module to be phased out eventually in favor of storing the CSRF settings solely in the CSRF View Middleware class.
See: https://code.djangoproject.com/ticket/21495