Remove unjustified @NoCSRFRequired from DbController::query(), bump max-version to 36

query() runs arbitrary admin SQL (including DELETE/UPDATE) and was
exempted from CSRF protection — a leftover from the original upstream
code, which had this alongside @PublicPage (no auth at all) before our
admin-check hardening. The client already goes through the standard
$.ajax() flow that auto-attaches Nextcloud's CSRF token, exactly like
OccController::cmd() does without any such exemption, so removing it
has no functional cost.

Also bump nextcloud max-version to 36 to match nc01's current core
version, now that AIO auto-updates the core nightly.

Version bump to 0.3.4.

appinfo/info.xml

@@ -5,7 +5,7 @@
     <name>Extended OCC Web</name>
     <summary>OCC Commands in a web terminal</summary>
     <description><![CDATA[Run OCC Commands in a web terminal]]></description>
-    <version>0.3.3</version>
+    <version>0.3.4</version>
     <licence>agpl</licence>
     <author mail="ebugaev@itkey.com" >Egor</author>
     <namespace>OCCWeb</namespace>
@@ -15,7 +15,7 @@
     <repository>https://github.com/fanategorius/occweb</repository>
     <screenshot>https://github.com/fanategorius/occweb/raw/main/appinfo/screenshot.png</screenshot>
     <dependencies>
-        <nextcloud min-version="30" max-version="35"/>
+        <nextcloud min-version="30" max-version="36"/>
     </dependencies>
     <navigations>
         <navigation role="admin">

lib/Controller/DbController.php

@@ -160,9 +160,6 @@ class DbController extends Controller
         return null;
     }
 
-    /**
-     * @NoCSRFRequired
-     */
     public function query()
     {
         // Check admin privileges