docs: document CSRF in JSON request body limitations

[gr8man]

Description

Adds a note in the CSRF documentation explaining that removing the CSRF token from a JSON object decodes and re-encodes the body (which affects formatting and may impact number precision), and recommends sending the token in the X-CSRF-TOKEN header instead if the body needs to remain intact.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[michalsn]

This is again a good catch, but I'd stick with unset() and json_encode() here. A custom JSON scanner adds maintenance overhead and can slow processing of larger, more complex payloads. That feels like a lot to take on for fairly uncommon cases. Formatting changes like 1.10 -> 1.1 don't change the number itself.

The precision issues are real, though, so I'd document the limitation. Anyone who needs to preserve the original JSON can send the CSRF token only in the header.

Something like this should be enough for the docs:

If you include the CSRF token in a JSON object, removing it decodes and re-encodes the body. This changes its formatting and may affect number precision. To keep the JSON body unchanged, send the token in the X-CSRF-TOKEN header and leave the CSRF field out of the body.