Make CSRF tokens identical on all nodes of a cluster

CSRF tokens are kept in a JVM-local map (DefaultCSRFToken). In a cluster behind a load balancer without sticky sessions, a form rendered by one node and submitted to another is rejected ("Secret CSRF token verification failed"), and a node restart invalidates every open form.

Proposal: derive the token deterministically with an HMAC of the authentication validation key (xwiki.authentication.validationKey, which a cluster already has to share for cookies to work) and the user reference, so every node computes the same token. Compare tokens in constant time.