RouteProcessorCsrf::processOutbound() should bubble 'session' cache context for non-HTML requests

Problem/Motivation

Discovered on Drupal core 11.3.7. After #3485174: Menu APIs provide invalid CSRF tokens, RouteProcessorCsrf::processOutbound() returns an actual CSRF token (instead of a render placeholder) for non-HTML requests. The bubbleable metadata is not updated with the session cache context, so when the URL is rendered into a cacheable response (e.g. via REST or JSON:API), the response is not keyed by session.

Same-role users sharing other cache contexts (e.g. user.permissions) get cached responses carrying each other's session-specific CSRF tokens.

The HTML branch's lazy-builder render callback already declares '#cache' => ['contexts' => ['session']] (RouteProcessorCsrf lines
79-81). The non-HTML branch should have the same semantics.

Steps to reproduce

Steps to reproduce

Reproducible against the existing core unit test:

1. Check out a clean Drupal 11.x and run core/tests/Drupal/Tests/Core/Access/RouteProcessorCsrfTest.php — all 5 tests pass.
2. In testProcessOutboundJsonFormat(), after the second processOutbound() call (the one that passes a fresh BubbleableMetadata), add:
   

   $this->assertContains('session', $bubbleable_metadata->getCacheContexts());

3. Run again — the new assertion fails, demonstrating that the non-HTML branch does not bubble the session cache context.

As manifested in practice: any code that generates a URL to a _csrf_token-protected route from a non-HTML context (e.g. a REST/JSON:API resource serving
a logout link) and embeds the URL in a cacheable response, will not see session in the response's bubbled cache contexts. If the response is otherwise
keyed only by role (user.permissions), users sharing the same role receive each other's cached tokens.

Proposed resolution

In RouteProcessorCsrf::processOutbound(), in the non-HTML / no-bubbleable-metadata branch, add the session cache context to the provided
metadata:

That would mirror the HTML-branch render callback (lines 79-81) which already declares the session context.

Remaining tasks

User interface changes

Introduced terminology

API changes

None. The method signature is unchanged. Bubbleable metadata gains an additional cache context; additive and BC-safe for callers reading metadata.

Data model changes

Release notes snippet