[6.x] Catch DecryptException with invalid X-XSRF-TOKEN

[antoinelame]

It fixes #33127.

For any POST, PUT, PATCH or DELETE request, anyone can change the X-XSRF-TOKEN value in the headers and cause a server error (500 response).

With this fix, if a user changes the value, the server will return a 419 – CSRF token mismatch response instead.