fix: guard against parse_str array injection in CSRF token handling #15491

Job	Run time
Setup PHP Version for Code Coverage	3s
Others (8.4) / Sanity Tests	15m 3s
Others (8.2) / Sanity Tests	2m 46s
Others (8.5) / Sanity Tests	1m 24s
Others (8.3) / Sanity Tests	1m 18s
CacheLive (8.4) / Cache Live Tests	1m 5s
CacheLive (8.2) / Cache Live Tests	1m 18s
CacheLive (8.3) / Cache Live Tests	1m 4s
SeparateProcess (8.3) / tests	2m 19s
SeparateProcess (8.2) / tests	2m 16s
CacheLive (8.5) / Cache Live Tests	1m 17s
SeparateProcess (8.5) / tests	2m 36s
DatabaseLive (8.2, SQLSRV, 8.0) / tests	5m 23s
SeparateProcess (8.4) / tests	2m 10s
DatabaseLive (8.3, MySQLi, 8.0) / tests	3m 15s
DatabaseLive (8.3, SQLSRV, 8.0) / tests	5m 28s
DatabaseLive (8.2, OCI8, 8.0) / tests	8m 15s
DatabaseLive (8.2, SQLite3, 8.0) / tests	2m 17s
DatabaseLive (8.4, MySQLi, 8.0) / tests	3m 38s
DatabaseLive (8.3, OCI8, 8.0) / tests	7m 15s
DatabaseLive (8.5, SQLite3, 8.0) / tests	1m 2s
DatabaseLive (8.3, Postgre, 8.0) / tests	1m 41s
DatabaseLive (8.4, OCI8, 8.0) / tests	6m 40s
DatabaseLive (8.5, Postgre, 8.0) / tests	1m 38s
DatabaseLive (8.4, Postgre, 8.0) / tests	1m 50s
DatabaseLive (8.4, SQLite3, 8.0) / tests	1m 7s
DatabaseLive (8.3, SQLite3, 8.0) / tests	57s
DatabaseLive (8.2, Postgre, 8.0) / tests	2m 29s
DatabaseLive (8.2, MySQLi, 5.7) / tests	3m 6s
DatabaseLive (8.5, SQLSRV, 8.0) / tests	4m 36s
DatabaseLive (8.4, SQLSRV, 8.0) / tests	4m 48s
DatabaseLive (8.5, MySQLi, 8.0) / tests	2m 55s
DatabaseLive (8.5, OCI8, 8.0) / tests	6m 54s
DatabaseLive (8.2, MySQLi, 8.0) / tests	4m 26s
Upload coverage results to Coveralls / coveralls	37s
	1h 54m 56s

Provide feedback