CSRF provider is not available if CSRF protection is disabled. This is a regression introduced in https://github.com/ezsystems/ezpublish-kernel/pull/654, which made provider service required.

Provider service should be made optional again to avoid fatal error when CSRF is disabled.