As a temporary measure until we have cacheable CSRF: let all forms add a csrf_token cache context?

Problem/Motivation

Currently, forms don't mark themselves as uncacheable. Even though only GET forms and forms for anon users are actually cacheable.

Proposed resolution

Until CSRF tokens are cacheable, add a csrf_token cache context and automatically add it to every form (except GET forms and except forms for anon users).

Correctness first.

Remaining tasks

TBD

User interface changes

None.

API changes

None.