Ruby: Update CSRF protection notes in documentation

Autofix is confused about how the `protect_from_forgery` method works in Rails >= 5: GPT-5 says:

> In modern Rails versions (>=5, including 6 and 7 which this gem permits), ActionController::Base already enables CSRF protection by default with the `:exception` strategy; an explicit call to `protect_from_forgery` without options does not weaken security.

This is false: manual testing confirms that it actually does downgrade from `:exception` to `:null-session` behaviour when a manual call is made.

I can't find any authoritative source showing this gotcha, so I can see how the AI is confused and how humans might also struggle to verify the truth.

Author: smowton

ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp

@@ -58,6 +58,11 @@
       for example if parts of the session are memoized. Calling
       <code>protect_from_forgery with: :exception</code> can help to avoid this
       by raising an exception on an invalid CSRF token instead.
+      Note this remains true even in Rails version 5 and later: these versions
+      automatically run <code>protect_from_forgery with: :exception</code>
+      by default, but manually calling <code>protect_from_forgery</code> with
+      no <code>with</code> argument will still downgrade protection to null the
+      session rather than raise an exception.
     </p>
 
   </example>