[FIX] website: restrict access to route

This route was public by mistake, probably introduced to test during
ddf32f4 but no reason to make it public, public user has not the write
access on models anyway.

Courtesy of Swapnesh Shah

closes odoo/odoo#44915

X-original-commit: 66ac96b25aa4cf2b074f6c06b57ed8be72d6d647
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

addons/website/controllers/main.py

@@ -307,7 +307,7 @@ class Website(Home):
         view.with_context(website_id=None).reset_arch(mode)
         return request.redirect(redirect)
 
-    @http.route(['/website/publish'], type='json', auth="public", website=True)
+    @http.route(['/website/publish'], type='json', auth="user", website=True)
     def publish(self, id, object):
         Model = request.env[object]
         record = Model.browse(int(id))