fix(dev): fix attribute import and CSP example in controllers.rst - #15703

Summary

Fixes three issues in developer_manual/basics/controllers.rst called out in #15679:

• Attributes example imported PublicPage but used #[NoAdminRequired] — import the attribute that is actually used.
• CSP example terminated the image-domain call with ;, breaking the media-domain chain, and never returned $response.
• Document #[PasswordConfirmationRequired] in the controller attributes list.

Closes #15679

Test plan

• Sphinx build of the developer manual succeeds for the controllers page
• Attribute example imports match the attributes used on index()
• CSP example is valid PHP (fluent chain + return $response;)
• Attribute list includes #[PasswordConfirmationRequired] with a one-line explanation

AI disclosure

This PR was drafted with the help of AI coding assistants (Cursor agents / LLM-based tools), including the description. I am responsible for it and happy to rework anything that doesn't fit.

All commits carry an Assisted-by: Cursor:grok-4.7 trailer.