request.values ignores form data for GET

[davidism]

request.values combines request.args and request.form. GET requests can have form bodies (although it's undefined / ambiguous in specs). Poorly implemented caching proxies may not understand that GET requests can have form data, which would allow form data to invisibly affect a public cached URL.

Now request.values won't use request.form if request.method == "GET".

Checklist:

• Add tests that demonstrate the correct behavior of the change. Tests should fail without the change.
• Add or update relevant docs, in the docs folder and in code.
• Add an entry in CHANGES.rst summarizing the change and linking to the issue.
• Add .. versionchanged:: entries in any relevant code docs.
• Run pre-commit hooks and fix any issues.
• Run pytest and tox, no tests failed.