Bug 41197: Don't require a CSRF token for opac-account-pay-return.pl

This page is intended for redirect/return from external payment vendors - they are not going to have/get a CSRF token from Koha for this.
The payments are handled in a POST to the API, so this should not be a sensitive page, it just provides user confirmation.
Some vendors use only a POST, we should not require CSRF on this page.

Test Plan:
1) Apply the first patch
2) prove t/Koha/Middleware/CSRF.t
3) Note the tests fail!
4) Apply this patch
5) prove t/Koha/Middleware/CSRF.t
6) All tests pass!

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>

Koha/Middleware/CSRF.pm

@@ -47,7 +47,8 @@ sub call {
     my $request_path   = $req->path    // q{};
 
     my %path_exceptions = (
-        '/ilsdi.pl' => 1,
+        '/ilsdi.pl'                   => 1,
+        '/opac-account-pay-return.pl' => 1,
     );
 
     #NOTE: Ignore ErrorDocument requests for CSRF