[Form] Enhance CSRF documentation with OWASP best practices and guidelines

[Spomky]

ping @javiereguiluz

As you mentioned, Symfony Forms add CSRF tokens by default, including for forms using the GET method.
This change clarifies that this practice is not recommended and points users to the section explaining how to disable CSRF protection.

[javiereguiluz]

Thanks Florent! We did some minor changes while merging:

• Merged in 6.4 branch and all the upper maintained branches
• Moved the note down a bit to include it in the form section (it felt a bit odd to show it at the very beginning of the article)
• Minor rewords in some phrases

[Spomky]

Perfect 👍. If it's good for you, it's good for me.