fix: restrict json rpc public methods

[ethever]

Summary

• fixes [SECURITY] JSON-RPC /rpc endpoint allows arbitrary method invocation #4601 by adding a read-only method allowlist for the aggregate /rpc endpoint
• blocks state-changing RPC methods such as submitProof, createProposal, and vote from being invoked through /rpc
• keeps existing REST routes unchanged
• rejects non-object JSON-RPC params before dispatch

Tests

• git diff --check origin/main...HEAD
• python3 -m py_compile rips/rustchain-core/api/rpc.py tests/test_json_rpc_method_whitelist.py
• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 uv run --no-project --with pytest --with flask python -m pytest tests/test_json_rpc_method_whitelist.py -q -> 3 passed
• python3 tools/bcos_spdx_check.py --base-ref origin/main -> OK

No live node or production RPC service was used.

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Your PR has a BCOS-L1 or BCOS-L2 label
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[ethever]

Checklist note: I do not have permission to apply repository labels from this fork. This is a JSON-RPC dispatch hardening fix for #4601; I would classify it as BCOS-L1 or BCOS-L2 depending on maintainer severity policy. Local validation and BCOS SPDX check are listed in the PR body.

Payout wallet / miner ID: b3a58f80a97bae5e2b438894aa85600cb0c066RTC

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[shuibui]

Code Review: Approve

Good fix.

**Verdict: Approve.

[ethever]

Closing this because it duplicates the older open fix #4802 for #4601. I missed that prior PR because the issue itself had no linked comment. Keeping the queue clean rather than asking maintainers to review duplicate JSON-RPC allowlist patches.