feat: harden the myep OAuth2 login

tests/Controller/DashboardControllerTest.php

@@ -70,7 +70,8 @@ class DashboardControllerTest extends WebTestCase
         $crawler = $this->client->request('GET', '/');
 
         self::assertCount(0, $crawler->filter('#mobilenav'));
-        self::assertCount(1, $crawler->filter('a[href="/logout"]'));
+        // The way out is a form, not a link: the firewall's logout is CSRF-protected.
+        self::assertCount(1, $crawler->filter('form[action="/logout"]'));
     }
 
     public function testATileCountsWhatIsStillFreeToday(): void

tests/Controller/Security/LogoutAuditTest.php

@@ -51,7 +51,11 @@ class LogoutAuditTest extends WebTestCase
         $this->em->flush();
 
         $this->client->loginUser($user);
-        $this->client->request('GET', '/logout');
+
+        // Submitted from the page rather than requested directly: the firewall's logout is
+        // CSRF-protected, so the token in the header form is part of what is being pinned down.
+        $crawler = $this->client->request('GET', '/');
+        $this->client->submit($crawler->filter('form[action$="/logout"]')->form());
 
         self::assertResponseRedirects();