Fixed #36874 -- Optimized CSRF token generation a bit.

[tim-lansen]

Trac ticket number

ticket-36874

Branch description

The functions _mask_cipher_secret and _unmask_cipher_secret now use pre-built translation table to get character indices.

AI Assistance Disclosure (REQUIRED)

• No AI tools were used in preparing this PR.
• If AI tools were used, I have disclosed which ones, and fully reviewed and verified their output.

Checklist

• This PR follows the contribution guidelines.
• This PR does not disclose a security vulnerability (see vulnerability reporting).
• This PR targets the main branch.
• The commit message is written in past tense, mentions the ticket number, and ends with a period.
• I have checked the "Has patch" ticket flag in the Trac system.
• I have added or updated relevant tests.
• I have added or updated relevant docs, including release notes if applicable.
• I have attached screenshots in both light and dark modes for any UI changes.

[github-actions]

Hello! Thank you for your contribution 💪

As it's your first contribution be sure to check out the patch review checklist.

If you're fixing a ticket from Trac make sure to set the "Has patch" flag and include a link to this PR in the ticket!

If you have any design or process questions then you can ask in the Django forum.

Welcome aboard ⛵️!

[github-actions]

���� Coverage Report for Changed Files

-------------
Diff Coverage
Diff: origin/main...HEAD, staged and unstaged changes
-------------
django/middleware/csrf.py (100%)
-------------
Total:   8 lines
Missing: 0 lines
Coverage: 100%
-------------

Note: Missing lines are warnings only. Some lines may not be covered by SQLite tests as they are database-specific.

For more information about code coverage on pull requests, see the contributing documentation.

[jacobtylerwalls]

Thanks for the PR 👍

[jacobtylerwalls]

Please remove the annotation.

[jacobtylerwalls]

Let's find another name without mentioning XLAT.

[jacobtylerwalls]

By populating the table with zeroes, this silences ValueErrors. Can you keep this performance tweak from introducing any behavior changes by ensuring some error is still emitted?

(I acknowledge the responsibility for checking for valid characters is in _check_token_format().)