Allow expressions when adding CSRF-exempted URIs

[morcen]

It would be nice if we could use named routes or config values inside the $except property of App\Http\Middleware\VerifyCsrfToken; however, having expressions as values inside the said property is frowned upon by PHP:

From IDE:

From browser (Flare?):

My suggestion is to add a mechanism that will allow the addition of CSRF-exempted URIs expressions, such as:

<?php
// app/Http/Middleware/VerifyCsrfToken.php
namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array<int, string>
     */
    protected $except = [
        '/bluepay',
    ];

    /**
     * Overrides \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::addExceptUrls()
     * All resolved URIs from this method will be merged with the values of the `$except` property
     */ 
    protected function addExceptUrls(): array
    {
        // can even do some logic here

        return [
            route('stripe.webhook'), 
            // other expressions
        ]; 
    }
}

Please have a look at my PR that will enable this: #48196

Happy to know everyone's thoughts about this!

🦞