PDF extractor API endpoints are accessible without authentication

[PascalRepond]

Bug description:

The two endpoints of the PDF extractor API accept a PDF from anyone, without
authentication:

• /api/pdf-extractor/metadata
• /api/pdf-extractor/full-text

They forward the file to Grobid, which is costly in CPU and memory, so the
endpoints can be used to exhaust the server resources.

The only page calling them, /pdf-extractor/test, does require a login.

Expected behavior:

Both endpoints should require an authenticated user.

Steps to Reproduce:

1. Make sure you are not logged in.
2. POST a PDF to /api/pdf-extractor/full-text, in a file form field.
3. See that the extracted text is returned with a 200.

Confirmed on sonardev: an anonymous POST to /api/pdf-extractor/full-text
returns 200 with the extracted text, and a POST to /api/pdf-extractor/metadata
runs Grobid (~2 s) without any login.

Context

• Versions: 1.12.4