Support `Sec-Fetch-Site`

I noticed Sec-Fetch-Site back in March 2025, from https://github.com/sinatra/sinatra/pull/2102#issuecomment-2889141955

(...because I was searching the rails repo for Sec-Fetch-Site because I was reading https://github.com/FiloSottile/csrf/blob/cfb6fbb0fbe34b0b2919ac81fa6dfe4678927dc5/csrf.go because I saw this)

And just now I learned about https://github.com/rails/rails/pull/56350 and https://github.com/SuperGoodSoft/csrf_protection and https://www.alexedwards.net/blog/preventing-csrf-in-go via https://github.com/rack/rack/issues/2367