Issue #3577774: Inject csrf_token and current_user services in MediaFilterController

Closes #3577774

MediaFilterController currently uses static service calls \Drupal::currentUser() and \Drupal::csrfToken(). These should be replaced with dependency injection.

This change injects the current_user and csrf_token services, updates the constructor and create() method, and replaces the static calls in checkCsrf() with the injected services. No functional changes expected.