Add docs about performance of HMAC vs Syncronizer, switch to HMAC as default

[samdark]

HMAC is stateless, so performance is way faster:

Factor	Synchronizer	HMAC
I/O per request	1 read + 1 write (file lock)	0
Session directory GC	1% of requests scan all files	Never triggered
File accumulation	Grows forever → GC gets slower and slower	Nothing to accumulate

To use it:

CsrfTokenInterface::class => [
    'class' => MaskedCsrfToken::class,
    '__construct()' => [
        'token' => Reference::to(HmacCsrfToken::class),
    ],
],

Drawbacks are:

1. Can't invalidate tokens.
2. Replay is possible within a lifetime window.
3. It relies on unique "session" IDs. If there's no session and no one logged in, CSRF doesn't work, i.e., for anonymous users.
4. Need a secret key.

[samdark]

HMAC

• Forms are only accessible to authenticated users (login form is the only
  exception, and it's low-risk — CSRF on a login form is a minor concern)
• You don't need token revocation on logout (most apps don't)
• You set a real secret key per environment

Synchronizer

• Unauthenticated users submit sensitive forms (payment, registration with personal
  data, password reset)
• You need guaranteed single-use tokens
• Session I/O cost is acceptable at your scale

[samdark]

Also need to note that HMAC's lifetime should be short enough, minutes and a secret key should come from env variable.