Add _csrf_token access control to rate routes

Problem/Motivation

The 8.x-1.x version of the module has a potential cross-site request forgery (CSRF) vulnerability.

Proposed resolution

The _csrf_token access control should be applied to the rate.vote and rate.undo_vote routes, as described in: https://www.drupal.org/docs/8/api/routing-system/access-checking-on-routes

Per the documentation on the above page, "CSRF protection...should be used for any URLs that perform actions or operations that do not use a form callback."

Remaining tasks

Provide and commit a patch.

ATTENTION: users are encouraged to upgrade to either 8.x-1.0-alpha7 OR upgrade to 3.0.1.
Users of the 8.x-1.0 branch are further encouraged to upgrade to 3.x as soon as possible.
The 8.x-1.0 branch is not supported, will not get further development, and may not get future security updates.

User interface changes

None

API changes

None

Data model changes

None