Deleted CsrfProtection class, its tests, ProtectorId constant, and validation message.
The addProtection() method now only triggers a deprecation warning.

HTML forbids nested <form> tags — browsers discard the inner <form>
and pollute the outer form with the orphaned inputs (breaking _do and
friends). When a layout needs to embed a component that renders its
own form (e.g. a datagrid in a sidebar), `detached` mode emits an
empty <form>...</form> at the opening position and links each control
rendered via {input}/{label}/n:name back to it using the HTML5
`form="frm-<name>"` attribute (applied lazily in Runtime::item()),
so inputs submit to the form regardless of where they live in the DOM.

Throws InvalidStateException when detached is used with a non-Form
Container or when the form has no id (which would silently produce
form="" and break submission).

The scope keyword (placed before the form name) makes {form} skip the
<form> tag emission while still pushing the form on the stack, so
{input}/{label}/{inputError} resolve against it. Semantically identical
to {formContext}, but stays with the canonical {form} tag.

The {form name attr=val} syntax (no comma between the name and the
attributes) was tolerated. Trigger E_USER_DEPRECATED when a token
follows the name without a comma, pointing to the offending column.
The form still compiles — this only nudges users toward the canonical
{form name, attr=val} so future syntax extensions can use bare
keywords next to the name unambiguously.

Protection using Sec-Fetch and Origin headers is comprehensive, as they cannot be spoofed even if there is an XSS vulnerability on the server