[FIX] website: restrict access to route

This route was public by mistake, probably introduced to test during
ddf32f4f but no reason to make it public, public user has not the write
access on models anyway.

Courtesy of Swapnesh Shah

closes odoo/odoo#44915

X-original-commit: 66ac96b2
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

addons/website/controllers/main.py

@@ -307,7 +307,7 @@ class Website(Home):
         view.with_context(website_id=None).reset_arch(mode)
         return request.redirect(redirect)
 
-    @http.route(['/website/publish'], type='json', auth="public", website=True)
+    @http.route(['/website/publish'], type='json', auth="user", website=True)
     def publish(self, id, object):
         Model = request.env[object]
         record = Model.browse(int(id))