Fix missing CSRF token on send SMS page

As part of https://github.com/alphagov/notifications-admin/pull/187 the file
upload pattern was changed to auto-submit once a file had been picked. The
form that was submitted was, however, missing a CSRF token, as well as a submit
button for non-JS users.

This commit makes the file upload pattern self-contained, so that it will always
include a form with a CSRF token in a hidden input and a submit button, which is
then hidden when Javascript loads.

app/templates/components/file-upload.html

@@ -1,5 +1,5 @@
 {% macro file_upload(field, button_text="Choose file") %}
-  <div class="form-group{% if field.errors %} error{% endif %}" data-module="file-upload">
+  <form method="post" enctype="multipart/form-data" class="form-group{% if field.errors %} error{% endif %}" data-module="file-upload">
     <label class="file-upload-label" for="{{ field.name }}">
       <span class="visually-hidden">{{ field.label }}</span>
       {% if hint %}
@@ -20,5 +20,7 @@
       {{ button_text }}
     </label>
     <label class="file-upload-filename" for="{{ field.name }}"></label>
-  </div>
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
+    <input type="submit" class="file-upload-submit" value="Submit" />
+  </form>
 {% endmacro %}

app/templates/views/check-sms.html

@@ -45,12 +45,7 @@
       <a href="{{url_for('.send_sms', service_id=service_id, template_id=template.id)}}" class="page-footer-back-link">Back</a>
     </form>
   {% else %}
-    <form method="post" action="{{ url_for('.send_sms', service_id=service_id, template_id=template.id) }}" enctype="multipart/form-data">
-      {{file_upload(form.file, button_text='Choose a CSV file')}}
-      {{ page_footer(
-        "Upload"
-      ) }}
-    </form>
+    {{file_upload(form.file, button_text='Upload a CSV file')}}
   {% endif %}
 
   {% call(item) list_table(

app/templates/views/send-sms.html

@@ -12,19 +12,16 @@
 
   <h1 class="heading-large">Add recipients</h1>
 
-  <form method="POST" enctype="multipart/form-data">
-
-    <div class="grid-row">
-      <div class="column-two-thirds">
-        {{ sms_message(template.formatted_as_markup) }}
-      </div>
+  <div class="grid-row">
+    <div class="column-two-thirds">
+      {{ sms_message(template.formatted_as_markup) }}
     </div>
+  </div>
 
-    <p>
-      <a href="{{ url_for('.get_example_csv', service_id=service_id, template_id=template.id) }}">Download an example CSV file</a>
-    </p>
+  <p>
+    <a href="{{ url_for('.get_example_csv', service_id=service_id, template_id=template.id) }}">Download an example CSV file</a>
+  </p>
 
-    {{file_upload(form.file, button_text='Upload a CSV file')}}
+  {{file_upload(form.file, button_text='Upload a CSV file')}}
 
-  </form>
 {% endblock %}