Add CSRF Token to Builder

[yeldarby]

Description

This passes through a CSRF token to the frontend iframe that it passes back when accessing the API. This will prevent random websites from performing destructive actions on the local server (since they won't know the CSRF token). It also prevents clickjacking attacks because the iframe won't be able to do anything unless is has access to a valid CSRF token (which an attacker won't know so won't be able to iframe the UI in a maliciously constructed page).

Update: this also includes #1056 (which was approved separately) with docs content that depends on this.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How has this change been tested, please provide a testcase or example of how you tested the change?

Locally & via staging. Only affects the new /build loginless UI.

Any specific deployment considerations

Won't actually work against prod until the frontend ships via the companion PR open on the core app repo.

Docs

• Docs updated? What were the changes: Yes, the guides that use this have now been merged in.

[iurisilvio]

I'd try to avoid these big copy/pastes because you lose any improvement they do to original code.

You can just extend original behavior.

class OurCORSMiddleware(CORSMiddleware):
    def __init__(
        self,
        app: ASGIApp,
        allow_origins: typing.Sequence[str] = (),
        allow_methods: typing.Sequence[str] = ("GET",),
        allow_headers: typing.Sequence[str] = (),
        allow_credentials: bool = False,
        allow_origin_regex: str | None = None,
        expose_headers: typing.Sequence[str] = (),
        max_age: int = 600,
        match_paths: str | None = None,
    ):
        super().__init__(
            app,
            allow_origins=allow_origins,
            allow_methods=allow_methods,
            allow_headers=allow_headers,
            allow_credentials=allow_credentials,
            allow_origin_regex=allow_origin_regex,
            expose_headers=expose_headers,
            max_age=max_age,
        )
        self.match_paths_regex = re.compile(match_paths) if match_paths else None

    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
        # If match_paths is provided and does not match, just skip to the next handler:
        if self.match_paths_regex is not None:
            path = scope.get("path", "")
            if not self.match_paths_regex.match(path):
                await self.app(scope, receive, send)
                return
        
        return super().__call_(scope, receive, send)

[yeldarby]

Good idea; will update.

[PawelPeczek-Roboflow]

letting @iurisilvio to handle this and set approval since he is more familiar with the topic

[iurisilvio]

LGTM, I think it is ok to have a simple CSRF implementation here.

I'd prefer to not copy/paste the middleware. I can approve again if you rewrite it with my idea.