Skip CSRF for reject (token-authenticated, no session)

[mroderick]

The reject endpoint authenticates by the invitation token in the URL. Unlike accept and update, it still
enforced CSRF — so a browser withholding the session cookie (for example Safari/WebKit ITP on cross-site
navigation) gets InvalidAuthenticityToken. This PR adds reject to the skip_forgery_protection
list and pins the token-only, no-session request.

One of five small PRs from the same pre-existing-gap audit against this flow. Heads are reviewed independently; if a sibling merges first expect a trivial rebase.

Detail

The mismatch showed up when writing the no-session spec: on master the spec fails with ActionController::InvalidAuthenticityToken. Join and leave (WaitingListsController#create/destroy) are already skipped and covered by analogous specs; reject is the odd one out.

Review notes

• This widens what a cross-site POST can invoke. The authenticator is the invitation token, which only email recipients hold; the reasoning is the same as for accept and update (PR fix: skip CSRF protection for feedback form submission #2641, Rollbar Security warning in Firefox #535). If you prefer to keep one CSRF-enforcing action in this controller, that would be accept — but consistency here makes the rules simpler to reason about.

Sibling PRs:

• Rejecting drops a cancelling member's waiting-list entry #2997 (fix/waiting-list-self-promotion-on-reject)
• Redirect instead of a 500 when the waiting-list entry is already gone #2998 (fix/waiting-list-destroy-missing-entry)
• Pin cross-role waiting list promotion #3000 (test/waitlist-cross-role-promotion)
• Assert the waiting-list promotion email on reject #3001 (test/waitlist-promotion-email)