fix(types): use void as csrfProtection's return type

[ojeytonwilliams]

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

Using any as the return type for csrfProtection made it incompatible with addHook, because csrfProtection was interpreted as an async hook with 3 params, which is not allowed.

Instead void seems like the appropriate return type because the function is only invoked for its side-effects.

[mcollina]

lgtm