feat(config): add box owner policy settings

Adds configuration options and environment variables to manage
box owner policies, including settings for refresh counts and expiry.

lib/server/admin_auth.go

@@ -181,6 +181,9 @@ func validAdminCSRF(ctx *gin.Context, session metastore.Session) bool {
 	}
 
 	token := ctx.PostForm("csrf_token")
+	if token == "" {
+		token = ctx.GetHeader("X-CSRF-Token")
+	}
 	return token != "" && subtleConstantTimeEqual(token, session.CSRFToken)
 }