Change refresh_watchlist_instances to POST

[damianhxy]

Description

• Modify refresh_watchlist_instances route to use POST
• Modify frontend js to use POST

Motivation and Context

Currently, the refresh endpoint uses GET and is vulnerable to CSRF attacks.

How Has This Been Tested?

• Go to a course and define a metric
• Accessing /courses/<course-name>/metrics/refresh_watchlist_instances should no longer work
• Clicking on refresh button works as expected
• Fudging CSRF token leads to request failing

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have run rubocop for style check. If you haven't, run overcommit --install && overcommit --sign to use pre-commit hook for linting
• My change requires a change to the documentation, which is located at Autolab Docs
• I have updated the documentation accordingly, included in this PR

[20wildmanj]

• verified that GET no longer works
• POST from different origin fails
• functionality remains unchanged
  LGTM!