feat: send a string body as a form or JSON, and hint at csrf()

[yusukebe]

A string body (request -d, or a string body in batch) without a content-type went as text/plain, so c.req.parseBody() saw nothing. On a form app, -d 'title=milk' returned 303 and added nothing — it looks like it worked. Now it goes as a form, or as JSON when it is a JSON object or array, like curl's -d. A content-type the user sets wins. In trials, 18 of 20 runs typed the form content-type by hand, 2 to 7 times each.

A 403 to a form POST without Origin or Sec-Fetch-Site now suggests sec-fetch-site: same-origin, the header Hono's csrf() expects from a browser. One trial run got that 403 five times before finding it.

The author should do the following, if applicable

• Add tests
• Run tests
• pnpm run format:fix && pnpm run lint:fix to format the code
• Add TSDoc/JSDoc to document the code