app/vlselect: restrict log deletion APIs to POST

[func25]

Restricts /delete/run_task and /internal/delete/run_task to the POST method to prevent GET-based SSRF attacks from deleting logs.

No "update note" is added as the deletion API is rarely used, migration only requires changing the method to POST, and rejected requests return a clear error explaining the required method. And security note is also highlighted at the top so the same as update note.

Fixes #1635

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[jiekun]

Previously when checking the PR for metrics I was thinking if we should move:

http.Error(w, fmt.Sprintf("Only POST method is allowed. Got %s.", r.Method), http.StatusMethodNotAllowed)

to a "public place". Do you have good candidate for it? If not, it's fine to keep the current one and replace later.

[cuongleqq]

Looks good. Since this is a security issue, can we add a small apptest test case to avoid regressions later?

[func25]

• move the check to the exact handler, and keep the message for public-facing changes so users know what happened. this could be inconsistent with how the project handles incorrect http methods.
• add apptest coverage