FIX: update and create_multiple actions missing from requires_login (#37715)

## Summary

`update` and `create_multiple` actions in `InvitesController` were
missing from the `requires_login only:` list, allowing unauthenticated
requests to bypass the `ensure_logged_in` check and reach the action
body.

It's not marked as a security commit as guardians were preventing any
exploit.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/304
- Original Commit:
https://github.com/discourse/discourse/blob/main/app/controllers/invites_controller.rb

---

🤖 Generated via [Patch Triage](https://patch.discourse.org/patch-triage)

app/controllers/invites_controller.rb

@@ -5,6 +5,8 @@ require "csv"
 class InvitesController < ApplicationController
   requires_login only: %i[
                    create
+                   create_multiple
+                   update
                    retrieve
                    destroy
                    destroy_all_expired

spec/requests/invites_controller_spec.rb

@@ -628,6 +628,15 @@ RSpec.describe InvitesController do
   end
 
   describe "#create-multiple" do
+    it "requires to be logged in" do
+      post "/invites/create-multiple.json",
+           params: {
+             email: %w[test@example.com test1@example.com],
+           }
+      expect(response.status).to eq(403)
+      expect(response.parsed_body["error_type"]).to eq("not_logged_in")
+    end
+
     it "fails if you are not admin" do
       sign_in(Fabricate(:user))
       post "/invites/create-multiple.json",
@@ -817,8 +826,9 @@ RSpec.describe InvitesController do
     fab!(:invite) { Fabricate(:invite, invited_by: admin, email: "test@example.com") }
 
     it "requires to be logged in" do
-      put "/invites/#{invite.id}", params: { email: "test2@example.com" }
-      expect(response.status).to eq(400)
+      put "/invites/#{invite.id}.json", params: { email: "test2@example.com" }
+      expect(response.status).to eq(403)
+      expect(response.parsed_body["error_type"]).to eq("not_logged_in")
     end
 
     context "while logged in" do