Update CSRF/antiforgery docs for deferred validation behavior

[DeagleGross]

Follow-up docs for dotnet/aspnetcore#67082 (defer antiforgery/CSRF rejection to form consumers). Keeping this as a draft — will be marked ready for review once #67082 is merged into dotnet/aspnetcore.

Summary

The merged docs for automatic CSRF protection in .NET 11 described the middleware as short-circuiting cross-origin write requests with 400. dotnet/aspnetcore#67082 changes that runtime behavior: the CsrfProtectionMiddleware now records its verdict on the shared IAntiforgeryValidationFeature and lets the request continue, and rejection is deferred to the components that consume the submitted form. This PR reconciles the docs with that model.

Files changed

• aspnetcore/security/csrf-protection.md

  • Reframed the intro and How it works to drop the short-circuit model — the middleware now produces an allowed/denied verdict recorded on the request.
  • Added a Deferred validation section: the verdict is recorded on IAntiforgeryValidationFeature and enforced only when a form consumer reads it (MVC antiforgery, minimal-API form binding, Blazor SSR, or a direct form read). Notes explicitly that JSON/non-form endpoints proceed even when the verdict is invalid.
  • Switched the Default behavior and Allowing cross-origin clients examples to form-based ([FromForm]) endpoints so the "rejected with 400" narrative is accurate.
  • Added Token validation takes precedence and Blazor server-side rendering sections.
  • Refreshed troubleshooting diagnostics (event name CsrfValidationFailed, "marked request … as invalid"), and a caveat note under Disabling globally.

• aspnetcore/migration/antiforgery-to-csrf.md

  • Added a Blazor static server-side rendering breaking-change subsection (removing app.UseAntiforgery() shifts protection to the CSRF middleware and stops antiforgery token generation).
  • Reframed the after-upgrade symptoms to cross-origin form posts, refreshed the log message, and added a caveat subsection for pure-antiforgery apps combined with DisableCsrfProtection or non-WebApplication hosts.

Both files have ms.date bumped and retain ai-usage: ai-assisted.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/breaking-changes/11/blazor-server-side-rendering-deferred-cross-site-request-forgery-protection.md	Blazor server-side rendering defers antiforgery validation to middleware
aspnetcore/breaking-changes/11/overview.md	Breaking changes in ASP.NET Core 11
aspnetcore/migration/antiforgery-to-csrf.md	Adopt automatic CSRF protection in .NET 11
aspnetcore/security/csrf-protection.md	Automatic CSRF protection in ASP.NET Core
aspnetcore/toc.yml	aspnetcore/toc

[wadepickett]

@DeagleGross, looks great! See the very minor items I suggested inline to consider.