Add check for disabled CSRF protection in Spring

Fix help and correct formatting.

Author: ggolawski

java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.qhelp

@@ -10,7 +10,7 @@ result in exposure of data or unintended code execution.</p>
 </overview>
 
 <recommendation>
-<p>Cross-Site Request Forgery (CSRF) protection is enabled by default. Spring's recommendation
+<p>When you use Spring, Cross-Site Request Forgery (CSRF) protection is enabled by default. Spring's recommendation
 is to use CSRF protection for any request that could be processed by a browser client by normal
 users.</p>
 </recommendation>

java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.ql

@@ -15,8 +15,8 @@ import java
 from MethodAccess call
 where
   call.getMethod().hasName("disable") and
-  call.getReceiverType().hasQualifiedName(
-    "org.springframework.security.config.annotation.web.configurers",
-    "CsrfConfigurer<HttpSecurity>"
-  )
+  call
+      .getReceiverType()
+      .hasQualifiedName("org.springframework.security.config.annotation.web.configurers",
+        "CsrfConfigurer<HttpSecurity>")
 select call, "CSRF vulnerability due to protection being disabled."