Fixes #18760 - Allow export to CSV

This introduces a way of exporting tables from the UI to CSV.
There are 3 steps to adding a CSV export to a table:

1. Add the CsvResponder concern to the relevant controller.
2. Add a `format.csv` block to the index controller action. This block
should include a call to `csv_response` with the wanted resources.
3. Add `csv_link` to the title actions. (Or wherever you want the export
button to appear)

By default, the csv will include all columns that exist for that model
in the database, except for the `created_at` and `updated_at` ones. To
override the default, add a method `csv_columns` to the controllers that
returns an array of columns. Columns can be actual column names in the
database, reflections, or any method that can be called on an instance
of the model.

This commit also includes an example of the feature implemented on the
Hosts index page.

refs #18760 - only build CSV URL from permitted params

Prevents malicious data being injected into the URL options (e.g. host)
and prevents a security exception rendering URLs with non-sanitised
params under Rails 5.0.

refs #18760 - exclude test routes from permission checks

Running test/controllers/concerns/csv_responder_test.rb and
access_permissions_test in sequence (e.g. in `rake test`) would cause
failures against the "fake" routes introduced by CsvResponderTest as no
permissions were defined.