feat(csrf): Support async IsAllowedSecFetchSiteHandler

[baseballyama]

This is IsAllowedSecFetchSiteHandler version of #4558

The author should do the following, if applicable

• Add tests
• Run tests
• bun run format:fix && bun run lint:fix to format the code
• Add TSDoc/JSDoc to document the code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.53%. Comparing base (489afe6) to head (74e8364).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4559   +/-   ##
=======================================
  Coverage   91.53%   91.53%           
=======================================
  Files         172      172           
  Lines       11228    11228           
  Branches     3260     3263    +3     
=======================================
  Hits        10278    10278           
  Misses        949      949           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR adds support for async IsAllowedSecFetchSiteHandler functions in the CSRF middleware, allowing users to perform asynchronous operations (like database lookups or API calls) when validating the Sec-Fetch-Site header.

• Updated the IsAllowedSecFetchSiteHandler type to support both synchronous and asynchronous handlers
• Modified the isAllowedSecFetchSite function to properly handle async handlers with await
• Added comprehensive test coverage for async handler scenarios

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/middleware/csrf/index.ts	Updated type definition and implementation to support async IsAllowedSecFetchSiteHandler with proper await handling
src/middleware/csrf/index.test.ts	Added comprehensive tests covering async handler functionality including allowed values, path-based bypass, and blocked requests

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yusukebe]

LGTM!

[yusukebe]

@baseballyama

I've fixed the conflict myself. Looks good. Thanks!