Adding @RequirePOST in a bunch of places where it seems to be missing.

Submitting as a PR in case this causes some test failures, or others think some methods were missed (quite likely), or there are some newly annotated methods for which GET seems valid.
I wonder if the `@RequirePOST` handler could be made to inject the CSRF crumb. Would somehow need to get this information from Jenkins core.