amp-form docs unclear about XSRF protection

### Description

At https://amp.dev/documentation/components/amp-form/?format=email#protecting-against-xsrf, it says:

> Only use POST for state changing requests.

It is not clear if this means "for anything other than state changing requests, don't use POST" or "for state changing requests, don't use anything other than POST."

### Reproduction Steps

Doc bug
https://amp.dev/documentation/components/amp-form/?format=email#protecting-against-xsrf

### Relevant Logs

_No response_

### Browser(s) Affected

_No response_

### OS(s) Affected

_No response_

### Device(s) Affected

_No response_

### AMP Version Affected

_No response_

Start at the amp-form documentation section linked in the issue, under “protecting against XSRF,” and review the sentence about using POST for state-changing requests. Clarify whether the guidance limits POST for non-state-changing requests or requires POST for state-changing requests. Done means the wording clearly communicates the intended rule.

Written by the indexing model from the issue text.