cmis.cmis_object_delete route is not protected against CSRF attacks

Problem/Motivation

This module has a CSRF vulnerability in version 8.x-2.0-alpha3.
The cmis.cmis_object_delete route deletes a CMIS object without checking a CSRF token.

Steps to reproduce

An attacker could trick an user with the "access all cmis browsers" permission to load a page containing code like this:

<img src="http://example.com/cmis/object-delete/foo/fd6ec7b8-e514-499b-9928-ba4a240d6bde%3B1.0?type=browser&parent=c4ec4d2b-9fc0-4c3d-b665-7cc7172531fe">

This could delete the CMIS object without the user approval.

Proposed resolution

The confirmation should probably be built with the ConfirmFormBase class.