Add CSRF protection to low security password changes

[r1kka6]

Summary

• require a valid anti-CSRF token before low-level password changes
• render the token field on the low-level CSRF form so legitimate requests still work

Verification

• docker run --rm -v "$PWD:/work" -w /work php:8.3-cli php -l vulnerabilities/csrf/source/low.php
• docker run --rm -v "$PWD:/work" -w /work php:8.3-cli php -l vulnerabilities/csrf/index.php
• built dvwa-ctf-csrf-low and verified an authenticated request without user_token gets a 302 redirect and leaves the password unchanged
• verified the same password change succeeds when the rendered token is supplied