fix(security): prevent CSRF bypass via domain boundary check on referer

[nyxsky404]

This PR fixes a security vulnerability in the custom CSRF validator (validateCsrf). The previous implementation used a naive referer.startsWith(a) string match, allowing attackers to bypass CSRF protections by registering subdomains like https://devtrack.com.attacker.com. The logic has been updated to strictly enforce the domain boundary by appending a trailing slash to the prefix match, preventing subdomain spoofing attacks. Fixes #3168.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus