feat(web): protect server functions from cross-site requests (CSRF)

[birkskyum]

Summary

• update @dom-expressions/runtime to the simulated 0.50.0-next.44 release
• expose the CSRF configuration through @solidjs/web/server-functions/server
• verify cross-site requests are rejected before dispatch and same-origin requests still work
• mark existing synthetic browser requests as same-origin

Prerequisite

Depends on dom-expressions#571.

This is intentionally separate from #3025. The lockfile uses a simulated 0.50.0-next.44 package containing both pending runtime changes and should be refreshed after that version is published.

Testing

• Solid Web build
• Solid, Solid Signals, and Solid Web type generation
• Solid Web server suite: 31 files, 282 passed, 2 skipped

[changeset-bot]

🦋 Changeset detected

Latest commit: d4be37e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@solidjs/web	Patch
@solidjs/element	Patch
@solidjs/h	Patch
@solidjs/html	Patch
test-integration	Patch
solid-js	Patch
babel-preset-solid	Patch
@solidjs/universal	Patch
@solidjs/signals	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR