Remove Servlet Spec 2.5 and 3.0 Support for CSRF

[jzheaux]

Related to #6220

The CookieCsrfTokenRepository attempts to use the setHttpOnly method only if that method is available in javax.servlet.http.Cookie.

Since Spring Framework 5.0 has a Servlet Spec baseline of 3.1, this check is no longer necessary.

We should always use the setHttpOnly method and remove any corresponding Servlet 2.5 or 3.0 tests.