feat: extend CSRF token protection to all api routes

[OEvgeny]

Description

This enables CSRF protection for /api calls, so Composer server can authenticate Composer client app.

Following changes were made:

• Added a token placeholder validation in development, so it is clear the API calls fail without the token during development
• Added X-CSRF-Token header to client's requests through axios interceptor
• Added code to the @bfc/shared package which exposes extended axios instance
• Changed client code to use the axios instance exposed from the @bfc/shared package
• Changed publishing extension to use the axios instance exposed from the @bfc/shared package

#minor

[coveralls]

Coverage decreased (-0.01%) to 54.637% when pulling c6b523f on OEvgeny:security/csrf-protection into a27c3e5 on microsoft:main.