Disallow mutating SQL in GET requests

[labkey-adam]

Rationale

For a long time (since 2019?) we've prohibited mutating SQL (INSERT, UPDATE, DELETE, etc.) via GET requests when running in dev mode with asserts on. It's past time to turn this on for production-mode deployments. This protects our customers from Cross-Site Request Forgery (CSRF) attacks. A deprecated feature flag can be enabled to turns this off temporarily in case a customer discovers a mutating action that isn't hasn't been migrated to POST. https://github.com/LabKey/kanban/issues/1941

Related Pull Requests

• Mutating SQL test testAutomation#3072

User Education

• Probably need a Release Note bullet about the change in behavior. Could lump this with other security "benefits".
• Could document the Deprecated Feature in the usual way. Although it's a little different in that we've added a flag that turns off a new feature.

Tasks 📍

• Claude Code Review
• Test Automation
• Manual Testing / Verify Fix @labkey-tchad