Fix 412 on contact search by opting out CSRF

Nextcloud checks the CSRF token on every controller method
without NoCSRFRequired, GET included. The invitee input's
bare fetch sends no request token, so the search answered
412 Precondition Failed. The endpoint is a read-only
address book query without side effects, so the attribute
is safe here.

lib/Controller/CalendarController.php

@@ -296,11 +296,14 @@ class CalendarController extends Controller
     /**
      * Live contact search for the invitee input.
      *
-     * Read-only GET endpoint, needs no CSRF protection.
+     * Read-only GET endpoint without side effects, so no CSRF
+     * protection is needed: the browser fetch sends no request
+     * token and would otherwise get a 412 response.
      *
      * @return DataResponse<Http::STATUS_OK, list<array{email: string, name: string}>>
      */
     #[NoAdminRequired]
+    #[NoCSRFRequired]
     public function searchContacts(string $query = ''): DataResponse
     {
         return new DataResponse($this->contactSuggestions($query));