Update CSRF protection details in aspnetcore.md (#10489)

* Update CSRF protection details in aspnetcore.md

Clarified the automatic CSRF protection feature in apps built with WebApplication.CreateBuilder, including details on its configuration and usage.

* Update release-notes/11.0/preview/preview6/aspnetcore.md

Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>

---------

Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>

Author: danroth27

release-notes/11.0/preview/preview6/aspnetcore.md

@@ -98,7 +98,7 @@ Validators run concurrently where possible: asynchronous attributes on the same
 
 ## Automatic cross-origin (CSRF) protection
 
-Apps built with `WebApplication.CreateBuilder` now automatically reject unsafe cross-origin requests based on the browser's `Sec-Fetch-Site` and `Origin` headers ([dotnet/aspnetcore #66585](https://github.com/dotnet/aspnetcore/pull/66585), [dotnet/aspnetcore #67082](https://github.com/dotnet/aspnetcore/pull/67082)). This lightweight cross-site request forgery (CSRF) protection is on with no configuration and applies across Minimal APIs, MVC, Razor Pages, and Blazor. Same-origin requests, user-initiated navigations, and non-browser clients are allowed, while a cross-origin browser request that tries to consume a form is rejected. It can be used in place of or alongside the existing token-based antiforgery system. Because it runs automatically, the Blazor Web App project templates no longer call `app.UseAntiforgery()`.
+Apps built with `WebApplication.CreateBuilder` now automatically reject unsafe cross-origin requests based on the browser's `Sec-Fetch-Site` and `Origin` headers ([dotnet/aspnetcore #66585](https://github.com/dotnet/aspnetcore/pull/66585), [dotnet/aspnetcore #67082](https://github.com/dotnet/aspnetcore/pull/67082)). This lightweight cross-site request forgery (CSRF) protection is on with no configuration and applies across Minimal APIs, MVC, Razor Pages, and Blazor. Same-origin requests, user-initiated navigations, and non-browser clients are allowed, while a cross-origin browser request that tries to consume a form is rejected. It can be used in place of or alongside the existing token-based antiforgery system. Because it runs automatically, Blazor Web App projects are no longer required to call `app.UseAntiforgery()`.
 
 To opt an endpoint out, use `.DisableAntiforgery()` (Minimal APIs) or `[IgnoreAntiforgeryToken]` (MVC); to turn the feature off app-wide, set the `DisableCsrfProtection` configuration key. For full control over the trust decision, register a custom `ICsrfProtection` implementation.