fix: restrict state-changing whitelisted endpoints to POST (#56858)

Add methods=["POST"] to 50 whitelisted functions that create or modify
documents (get_doc followed by insert/save/submit), so they can no
longer be invoked via GET requests.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

erpnext/support/doctype/issue/issue.py

@@ -117,7 +117,7 @@ class Issue(Document):
 		communication.flags.ignore_mandatory = True
 		communication.save()
 
-	@frappe.whitelist()
+	@frappe.whitelist(methods=["POST"])
 	def split_issue(self, subject: str, communication_id: str):
 		from copy import deepcopy
 
@@ -273,7 +273,7 @@ def make_task(source_name: str, target_doc: str | Document | None = None):
 	return get_mapped_doc("Issue", source_name, {"Issue": {"doctype": "Task"}}, target_doc)
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def make_issue_from_communication(communication: str, ignore_communication_links: bool = False):
 	"""raise a issue from email"""
 

erpnext/support/doctype/service_level_agreement/service_level_agreement.py

@@ -779,7 +779,7 @@ def get_response_and_resolution_duration(doc):
 	return priority
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def reset_service_level_agreement(doctype: str, docname: str, reason: str, user: str):
 	if not frappe.db.get_single_value("Support Settings", "allow_resetting_service_level_agreement"):
 		frappe.throw(_("Allow Resetting Service Level Agreement from Support Settings."))