“Section 230's immunity does not bar federal criminal enforcement, allowing the Department of Justice to take action against platforms for violations of federal CSAM laws or the Take It Down Act.”