Drop unhelpful note about CSRF from CORS doc

[sideshowbarker]

If we’re going to mention CSRF in the CORS article, we would need to say quite a lot more than what this note says. And since this note is wrongly saying that you don’t need to worry at all about CSRF in a specific subset of cases (simple requests), it may give the very wrong impression that CORS overall doesn’t create any additional CSRF risk.

So it’s better to mention nothing at all about CSRF in this CORS article than it is to have this one mention in this one odd note.

Fixes #4111

[sideshowbarker]

@hamishwillee Pinging you because I know you care about the CORS article and have invested a lot of work in it. Would be good to get your call on whether this note is serving any useful purpose. I understand what the intent was of whoever added it — but a “you don’t need to worry about CSRF” message, even for a specific limited context, doesn’t seem prudent. And I don’t see any way to salvage the note without spending a good chunk of time to write further text to clarify things.