Make Devise::FailureApp commit the CSRF token on Rails 7.1+.

[augustocbx]

Rails 7.1 changed CSRF token storage (rails/rails#44283) so the deferred token is committed to the session at the end of the request through the controller instance, which must respond to commit_csrf_token. Devise::FailureApp extends ActionController::Metal (not ActionController::Base) and becomes that controller instance when :warden is thrown, so on an authentication failure the deferred CSRF token — and the session itself — were silently dropped (no session cookie returned).

This includes ActionController::RequestForgeryProtection in Devise::FailureApp so it provides commit_csrf_token, restoring CSRF token and session persistence on auth failure. Only FailureApp needs this, since real controllers already get it from ActionController::Base.

Fixes #5698.