feat(ingester): restrict /flush and /shutdown endpoints to POST only

[Goutham-Annem]

What this PR does:

The /ingester/flush, /ingester/shutdown, /flush, and /shutdown endpoints previously accepted GET requests, making it possible to accidentally trigger a destructive ingester operation by clicking a link in a browser or via a pre-fetch proxy following the index page's links.

This PR makes three coordinated changes:

1. Route restriction (pkg/api/api.go): The four flush/shutdown RegisterRoute calls now only list "POST". A browser GET (or curl without -X POST) returns 405 Method Not Allowed.

2. Index page template (pkg/api/handlers.go): Links in the Dangerous: section now render as <form method="POST"><button> elements instead of <a href> anchors. This ensures that clicking in the browser issues a POST, not a GET. Non-dangerous links continue to render as plain anchors. A template function IsDangerous(section string) bool drives the branching.

3. Migration script (tools/migrate-ingester-statefulsets.sh): The BusyBox wget invocation inside kubectl exec is updated to wget --post-data="" -T 5 .... BusyBox wget supports --post-data, so the script continues to work without requiring curl inside the Cortex container image (which is unavailable per the original issue discussion).

Which issue(s) this PR fixes:
Fixes #3243

Checklist

• Tests updated — TestIndexPageContent extended with assertions that dangerous links produce method="POST" forms and no <a href>; new TestIndexHandlerDangerousLinksUsePostForms covers prefix behaviour for dangerous links
• CHANGELOG.md updated
• Documentation added (N/A — behaviour is visible in the UI itself)

Note: This PR was developed with AI assistance (Claude Code).