Add SensitiveParameter attribute to CsrfTokenGenerator::validate()

Problem/Motivation

If an attacker gets access to error logs and CsrfTokenGenerator::validate() throws an exception, it could leak valid CSRF tokens in the stack trace:

RuntimeException:
Missing $settings['hash_salt'] in settings.php.

  at core/lib/Drupal/Core/Site/Settings.php:173
  at Drupal\Core\Site\Settings::getHashSalt()
     (core/lib/Drupal/Core/Access/CsrfTokenGenerator.php:115)
  at Drupal\Core\Access\CsrfTokenGenerator->computeToken('yZyPqDjxGaPr_PKQ_u5GrSzhZ6cxTX8yw_w6RSFdsLs', '')
     (core/lib/Drupal/Core/Access/CsrfTokenGenerator.php:89)
  at Drupal\Core\Access\CsrfTokenGenerator->validate('valid_token')
     (modules/custom/test/test.module:50)

Steps to reproduce

Very crude way to trigger an exception;

  ini_set('zend.exception_ignore_args', FALSE);
  new Settings([]);
  \Drupal::csrfToken()->validate('valid_token');

Proposed resolution

Add #[SensitiveParameter] to the $token argument.

Maybe the $seed argument in computeToken() should also be considered sensitive.
(I don't think you can do anything dangerous with only the seed, you would also need the private and the hash salt.)

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet