[Blazor] Add support for antiforgery

[javiercn]

• Adds a new IAntiforgeryMetadata interface to describe the antiforgery requirement.
• Adds a new RequireAntiforgeryToken attribute to require antiforgery.
• Adds RequireAntiforgeryToken to all razor component endpoints.
• Adds a new AntiforgeryTokenStateProvider service that retrieves and renders the antiforgery token for the app.
• Adds a new AntiforgeryToken component that renders the request antiforgery token as a hidden field.
• Makes EditForm automatically render the AntiforgeryToken when inside of a form binding context.

[SteveSandersonMS]

Is the idea that people would write <... @onsubmit:name> with no value?

[javiercn]

You can do no value, but more commonly you would do @onsubmit:name="" which gets translated to true, which is what this code avoids. Once the directive for the razor compiler is in, this will just be SetEventHandlerName

[SteveSandersonMS]

Looks great!

The only remaining thing is an idea that, since AntiforgeryStateProvider only uses PersistentComponentState as an internal implementation detail, it would be ideal not to couple the public API to that. For example, AntiforgeryStateProvider itself could be reduced to an abstract base class or interface that only describes the public API, and then we could have a shared-source DefaultAntiforgeryStateProvider that uses PersistentComponentState and is used in WebAssembly and in Endpoints.

I don't want to hold up your PR with this though. If you feel inclined to do that, that's great. If not, would you be OK with me doing that as a follow-up afterwards? The point is just to keep the public API as lean as it can be, and give us flexibility to change the set of services this depends on over time.

[javiercn]

If not, would you be OK with me doing that as a follow-up afterwards? The point is just to keep the public API as lean as it can be, and give us flexibility to change the set of services this depends on over time.

That's absolutely fine, I was trying to avoid the need for an additional abstraction, but your point is fair and I don't feel strongly about it. I'll update the PR to change it.