Require POST for action=purge in PurgeAction

Require POST for action=purge in PurgeAction

For the index.php end point, POSTs do not need a token.

This avoids cross-DC writes in active/active DC setups and
avoids DB writes that can be caused by just accidentally
following a link.

There are no links to action=purge by default in MediaWiki.
User scripts that create purge links will continue to work.
However these links will now point to a confirmation form.
To preserve the immediate-purge-redirect effect, these
scripts should be updated to use the API instead.

Bug: T135170
Change-Id: I5749ff470d99c5e3f22e05ff6856394cc05a0f48