feat(ingester): restrict /flush and /shutdown endpoints to POST only

[Goutham-Annem]

What this PR does:

The /ingester/flush, /ingester/shutdown, /flush, and /shutdown endpoints previously accepted GET requests, making it possible to accidentally trigger a destructive ingester operation by clicking a link in a browser or via a pre-fetch proxy following the index page's links.

This PR makes three coordinated changes:

1. Route restriction (pkg/api/api.go): The four flush/shutdown RegisterRoute calls now only list "POST". A browser GET (or curl without -X POST) returns 405 Method Not Allowed.

2. Index page template (pkg/api/handlers.go): Links in the Dangerous: section now render as <form method="POST"><button> elements instead of <a href> anchors. This ensures that clicking in the browser issues a POST, not a GET. Non-dangerous links continue to render as plain anchors. A template function IsDangerous(section string) bool drives the branching.

3. Migration script (tools/migrate-ingester-statefulsets.sh): The BusyBox wget invocation inside kubectl exec is updated to wget --post-data="" -T 5 .... BusyBox wget supports --post-data, so the script continues to work without requiring curl inside the Cortex container image (which is unavailable per the original issue discussion).

Which issue(s) this PR fixes:
Fixes #3243

Checklist

• Tests updated — TestIndexPageContent extended with assertions that dangerous links produce method="POST" forms and no <a href>; new TestIndexHandlerDangerousLinksUsePostForms covers prefix behaviour for dangerous links
• CHANGELOG.md updated
• Documentation added (N/A — behaviour is visible in the UI itself)

Note: This PR was developed with AI assistance (Claude Code).

[friedrichg]

this should trigger a change in the docs too https://cortexmetrics.io/docs/api/#shutdown

[Goutham-Annem]

Gentle ping — CI is passing, happy to address any feedback.

[Goutham-Annem]

Gentle ping — CI is passing and there are no conflicts. Happy to address any feedback!

[friedrichg]

I am ok with this.
But also brings the question of what should happen with /ingester/mode and /ingester/renewTokens

[Goutham-Annem]

Good point — extended the PR to also restrict /ingester/renewTokens and /ingester/mode to POST-only. Both are already in SectionDangerous, so the index page template already renders them as POST forms (including the query string in the action attribute, so mode=READONLY / mode=ACTIVE still work). No test changes needed since neither endpoint has dedicated API tests.