FIX: remove_bookmarks missing from requires_login (#37676)

## Summary

The `remove_bookmarks` action in `TopicsController` was missing from the
`requires_login` list, allowing anonymous users to hit the endpoint and
trigger a 500 error (NoMethodError on nil) instead of receiving a proper
403 response. There's no security concern as we would after check for a
current_user, but it's much cleaner to fail early with a clean error.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/203
- Original Commit:
https://github.com/discourse/discourse/blob/main/app/controllers/topics_controller.rb

---

🤖 Generated via [Patch Triage](https://patch.discourse.org/patch-triage)

app/controllers/topics_controller.rb

@@ -27,6 +27,7 @@ class TopicsController < ApplicationController
                    move_to_inbox
                    convert_topic
                    bookmark
+                   remove_bookmarks
                    publish
                    reset_bump_date
                    set_slow_mode

spec/requests/topics_controller_spec.rb

@@ -4438,6 +4438,11 @@ RSpec.describe TopicsController do
   end
 
   describe "#remove_bookmarks" do
+    it "requires the user to be logged in" do
+      put "/t/1/remove_bookmarks.json"
+      expect(response.status).to eq(403)
+    end
+
     it "should remove bookmarks properly from non first post" do
       sign_in(user)