Mock Jwt should ensure that CSRF is not required

[jzheaux]

According to #7118, when using jwt() (Servlet) or mockJwt() (WebFlux) test support, a tester must also provide a CSRF token.

This is because the CSRF token is lifted when a bearer token header is present in the request.

But, when using jwt() or mockJwt(), no bearer token header is provided as it's unnecessary.

In order to align with the expected behavior of resource server endpoints, when jwt() or mockJwt() is used, the tester should not also have to supply a CSRF token.