Prevent CSRF uploads via /file/dropupload/

Summary:
We don't currently validate CSRF tokens on this workflow. This allows an
attacker to upload arbitrary files on the user's behalf. Although I believe the
tight list of servable mime-types means that's more or less the end of the
attack, this is still a vulnerability.

In the long term, the right solution is probably to pass CSRF tokens on all Ajax
requests in an HTTP header (or just a GET param) or something like that.
However, this endpoint is unique and this is the quickest and most direct way to
close the hole.

Test Plan:
  - Drop-uploaded files to Files, Maniphest, Phriction and Differential.
  - Modified CSRF vaidator to use __csrf__.'x' and verified uploads and form
submissions don't work.

Reviewers: andrewjcg, aran, jungejason, tuomaspelkonen, erling
Commenters: andrewjcg, pedram
CC: aran, epriestley, andrewjcg, pedram
Differential Revision: 758

src/applications/files/controller/dropupload/PhabricatorFileDropUploadController.php

@@ -22,6 +22,9 @@ class PhabricatorFileDropUploadController extends PhabricatorFileController {
     $request = $this->getRequest();
     $user = $request->getUser();
 
+    // NOTE: Throws if valid CSRF token is not present in the request.
+    $request->validateCSRF();
+
     $data = file_get_contents('php://input');
     $name = $request->getStr('name');