fix(core): add CSRF token to HordePopup.popup at click time

[TDannhauer]

Summary

• Add only the CSRF token to every HordePopup.popup() URL at click time via new HordeCore.addCsrfToken() (no legacy SID query parameter).
• Ensure token_secret_key exists before read-only sessions are closed, so download/view scripts can validate HMAC tokens.
• Fix ViewModeConfigurator to expose a modern HMAC HordeCore.conf.TOKEN instead of the legacy empty session slot.
• Register TokenServiceFactory explicitly in DefaultInjectorBindings and use use imports in Registry to avoid doubled namespace resolution.

Motivation

After Horde 6 switched to HMAC CSRF tokens, IMP links that open MIME parts in a popup (e.g. “View HTML data in new window”) failed with “Invalid token!” and showed the portal instead of the message. Horde::popupJs() uses HordePopup.popup(), which never appended a token parameter, unlike HordeCore.popupWindow().

Session identity must stay in cookies/headers, not URL query parameters (review feedback).

Changes

• js/hordecore.js: add HordeCore.addCsrfToken() (token only).
• js/popup.js: call HordeCore.addCsrfToken() before window.open().
• lib/Horde/Registry.php: seed per-session CSRF secret before SESSION_READONLY close.
• src/DefaultInjectorBindings.php: explicit Token::class => TokenServiceFactory::class binding.
• src/PageOutput/ViewModeConfigurator.php (+ factory, tests): use Horde\Token\Token for TOKEN.

Test plan

• Open an HTML message in IMP dynamic view; click “View HTML data in new window”; popup shows rendered HTML.
• No “Invalid token!” growler messages in the parent window.
• Other Horde::popupJs() popups (help, prefs import, etc.) still open and authenticate correctly.
• vendor/bin/phpunit --bootstrap vendor/autoload.php -c vendor/horde/core/phpunit.xml.dist vendor/horde/core/test/Unit/PageOutput/ViewModeConfiguratorTest.php vendor/horde/core/test/Unit/PageOutput/ViewModeConfiguratorDiscovererTest.php vendor/horde/core/test/Unit/Factory/TokenServiceFactoryTest.php

[ralflang]

I don't like adding session ID to ajax URLs like its 1998. These belong into a header (cookie or other).

[TDannhauer]

Feel free to adapt 🙂

Session and tokens is your Expertise

[TDannhauer]

@ralflang Addressed in fc1e3d5: popups now use new HordeCore.addCsrfToken() which appends only the CSRF token at click time — no SID in the URL. Session auth stays on cookies.

Also fixed the TokenServiceFactory DI binding / Registry imports so bootstrap no longer resolves a doubled Horde\Core\Horde\Core\... class name.

[ralflang]

The TOKEN field is now generated on every page render rather than read from a session slot. That means each dynamic-view page render mints a new token. We used to reuse from session. Anyway we are going to migrate off Horde_Registry in the longer run.