Turn Planet off by default and require POST for its admin changes

[snoopdave]

Summary

• Planet is now off by default (planet.aggregator.enabled=false). Few sites use the aggregator. Until now, turning it off only hid the admin menu: the Planet admin actions and the /planetrss feed still answered. Now, while it is off, the Planet admin actions are refused and /planetrss returns 404.
• Planet changes require POST. PlanetUIAction.isPostRequest() is checked at the start of the five methods that save or delete Planet configuration, groups and subscriptions; any other request method gets DENIED. The forms already submit by POST, so the UI is unchanged. This follows the inline check FrontpageSetup already uses.
• UISecurityEnforced.isFeatureEnabled(), a default method checked first by UISecurityInterceptor, lets an optional feature switch off all of its actions in one place. PlanetUIAction ties it to planet.aggregator.enabled.

Upgrade note

Sites that use Planet must set planet.aggregator.enabled=true in roller-custom.properties when they upgrade, or the Planet pages and feed will be unavailable.

Testing

• PlanetAvailabilityTest: a GET to each of the five Planet change methods is refused without touching the Weblogger; only a POST counts as a POST request; the Planet setting's default and its effect on actions, /planetrss and the Planet tasks.
• On JDK 11 after the inline-check change: PlanetAvailabilityTest 7/7, ValidateSaltInterceptorTest 7/7, UIActionTest 3/3. CI runs the full suite on JDK 11, 17, 21 and 25.

Targets roller-6.1.x for 6.1.7. It will be cherry-picked to master after the 6.1.7 release.

[snoopdave]

PR-Review: 1 inline comment posted.

[snoopdave]

🐞Claude Issue: PR-Review: General Issues

The following issues were found but cannot be attached to a specific line in the diff:

• Blocking: CHANGES.md on roller-6.1.x is not updated. This is a default change that breaks existing sites: Planet admin pages and /planetrss go dark on upgrade unless planet.aggregator.enabled=true is set. The upgrade note in the PR description belongs in CHANGES.md (and the 6.1.7 release notes), not only here.
• Important: RefreshRollerPlanetTask and SyncWebsitesTask do not check planet.aggregator.enabled. They are not in the default tasks.enabled. But a site that has added them and then upgrades will keep fetching subscribed feeds with Planet "off". If off is meant to mean off, have both tasks return early when the flag is false.
• Important: No CI runs on this PR, because the roller-6.1.x workflows trigger only for master. I ran PlanetAvailabilityTest (6) and RequiresPostInterceptorTest (5) locally on JDK 11: all pass. I also confirmed that every state-changing Planet action method (save, saveGroup, saveSubscription, deleteSubscription, delete) is annotated.

[snoopdave]

🤖Claude:

• CHANGES.md: fixed by adding a 6.1.7 section (not yet pushed). It covers the new default: admin pages, /planetrss and the Planet tasks are inactive until planet.aggregator.enabled=true is set. It also says Planet admin changes now require POST.
• Planet tasks: fixed. RefreshRollerPlanetTask.runTask and SyncWebsitesTask.runTask now return early while planet.aggregator.enabled is false. New test PlanetAvailabilityTest.planetTasksDoNothingWhileOff checks that neither task touches the Weblogger while Planet is off. PlanetAvailabilityTest: 7/7 pass on JDK 11.
• CI: not fixed here. Run CI and CodeQL on roller-6.1.x #206 has since added roller-6.1.x to the CI and CodeQL triggers; checks will start after this PR is rebased onto roller-6.1.x.

[snoopdave]

ready for merge.

[snoopdave]

Manually tested on the 6.1.7 integration build (Tomcat 9, JDK 11, MySQL 8). Pass.

• Planet off (the new default):
  • No Planet tabs appear, and the three Planet admin pages show "Permission Denied" to an admin.
  • /planetrss returns 404.
  • With both Planet tasks enabled, each logs "Planet is disabled; not running".
• Planet on:
  • The tabs and pages work.
  • Config save, group save, adding a subscription and deleting a subscription all work as POST.
  • The same five actions sent as GET with a valid salt are denied, and the database is unchanged.
  • /planetrss returns a feed.

One older bug, not caused by this PR: on a new site, the feed's title and description printed the literal $utils.escapeXML($siteName) until Planet Config was first saved. That is fixed in #207.