Document antiforgery HTTP method limitations and HttpMethodOverride interaction

[GrantTotinov]

Document antiforgery HTTP method limitations and HttpMethodOverride interaction

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Description

Documents that AntiforgeryMiddleware and UseAntiforgery() only validate HTTP POST, PUT, and PATCH requests. Adds guidance for developers who need validation for other HTTP methods (for example, DELETE) to resolve IAntiforgery from DI and call ValidateRequestAsync or IsRequestValidAsync explicitly.

Also documents the interaction with HttpMethodOverrideMiddleware when configured with FormFieldName, where a POST request can be overridden to DELETE and bypass antiforgery validation.

Fixes #66687

[dotnet-policy-service]

Thanks for your PR, @GrantTotinov. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[Copilot]

Pull request overview

This PR updates public API documentation to clarify antiforgery validation’s HTTP method scope and the security implications when combined with HttpMethodOverrideMiddleware (form-field mode), addressing scenarios where an overridden method like DELETE can bypass antiforgery middleware validation.

Changes:

• Document that antiforgery middleware (UseAntiforgery / AntiforgeryMiddleware) only validates tokens for POST, PUT, and PATCH.
• Add guidance for validating other HTTP methods by explicitly calling IAntiforgery.ValidateRequestAsync / IsRequestValidAsync.
• Document the interaction between form-field HTTP method override and antiforgery validation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/Middleware/HttpOverrides/src/HttpMethodOverrideExtensions.cs	Adds remarks warning about form-field method override rewriting the request method before later middleware, and notes antiforgery method limitations.
src/Antiforgery/src/RequireAntiforgeryTokenAttribute.cs	Adds remarks clarifying that UseAntiforgery validation is limited to POST/PUT/`PATCH and how to validate other methods manually.
src/Antiforgery/src/AntiforgeryApplicationBuilderExtensions.cs	Adds remarks describing antiforgery method limitations, manual validation options, and the method-override interaction.