Copies a Datastar CSRF signal into _csrf_token for Plug.CSRFProtection.
POST/PUT/PATCH signals arrive in parsed body params. GET/DELETE signals
arrive in the JSON datastar query parameter. Existing body _csrf_token
values take precedence; a query _csrf_token cannot suppress a valid body
or Datastar token. Tokens in GET/DELETE URLs should be redacted from logs.
Sending an x-csrf-token header does not remove the signal from the query;
also exclude that signal from URL-based requests if using headers instead.
If the body is still unfetched, query/params tokens are copied to the request
header instead of body params so later signal fetching can consume the raw
body. An explicit x-csrf-token header is preserved.
Add it before :protect_from_forgery when using Datastar form mode:
plug StarView.Plug.RenameCsrfParam
plug :protect_from_forgery