Issue #3019665: Preserve CSRF token seed across masquerade session regeneration

Masquerade::switchUser() regenerates the session ID on every switch (and switch back) to prevent session fixation. Drupal core's MetadataBag:: stampNew() also stamps a brand new CSRF token seed whenever the session is regenerated, which invalidates every CSRF token already rendered for that browser session.

A page can show masquerade links for several target users at once (e.g. the people list). Masquerading as one of them, then switching back, regenerates the session twice, silently invalidating the not-yet-used links for the other users on that same page. Clicking one of them next fails with "access denied" until the page is reloaded, matching the reports of masquerade failing on retry.

Preserve the CSRF token seed across the session ID regeneration so outstanding tokens keep working; the session ID itself still changes, which is what actually guards against session fixation.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

Closes #3019665