Add CSRF protection

[Shane32]

Requires CORS preflight requests by ensuring that the requests are not 'simple' - e.g. GET request or form-POST requests - or that a specific header has been added to the request.

See similar logic: https://www.apollographql.com/docs/apollo-server/security/cors/#preventing-cross-site-request-forgery-csrf

The chosen default header was based on the current proposal by the GraphQL working group. See:

• Add security and compatibility notes graphql/graphql-over-http#303

[github-actions]

Coverage Report

Totals
Statements:	95.8% ( 1847 / 1928 )
Methods:	80.45% ( 284 / 353 )

[coveralls]

Pull Request Test Coverage Report for Build 10445976819

Details

• 9 of 33 (27.27%) changed or added relevant lines in 3 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-1.6%) to 92.933%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/GraphQL.AspNetCore3/GraphQLHttpMiddlewareOptions.cs	0	2	0.0%
src/GraphQL.AspNetCore3/Errors/CsrfProtectionError.cs	0	3	0.0%
src/GraphQL.AspNetCore3/GraphQLHttpMiddleware.cs	9	28	32.14%

Totals
Change from base Build 10445715614:	-1.6%
Covered Lines:	1847
Relevant Lines:	1928

---

💛 - Coveralls