(PXP-7565): Exclude Fence register-user blueprint from CSRF check

[vpsx]

TLDR:
The revproxy currently implements CSRF checks using the cookie-to-header method.
Fence's new registration form, like other HTML forms, is not compatible with this method. The usual way to implement CSRF protection with HTML forms is using a hidden form field.
So here we exclude the Fence registration endpoints from the revproxy CSRF check. This is OK because Fence implements its own CSRF checks.

Here is the relevant Fence PR (implementing registration endpoints) uc-cdis/fence#906

For the record, more background on cloud-auto CSRF history:

Fence has been operating under the assumption that it manages its own CSRF token.
But actually the revproxy rewrites the token and performs its own CSRF checking.

At time of PR, the revproxy CSRF check looks like this.
That code can be traced back to this commit and this commit.

At some point between then and now, the "return 403 failed csrf check" bit migrated from the main nginx.conf into the individual *-service.conf files.

---

Jira Ticket: PXP-7565

New Features

Breaking Changes

Bug Fixes

Improvements

Dependency updates

Deployment changes