fix(dav): Prevent email link scanners from triggering invitation accept/decline

[Sam428-png]

Summary

Email security scanners (e.g. Microsoft Exchange Safe Links / ATP) crawl all URLs in emails via GET requests. This inadvertently triggers both the accept and decline endpoints for calendar invitations simultaneously, causing meetings to be accepted or declined before the user can respond.

• accept() and decline() no longer process the iTip response directly — they now show a confirmation page with the appropriate option preselected
• The actual action is only performed via POST through processMoreOptionsResult(), which scanners never trigger (they only issue GET/HEAD requests)
• Updated template with a compact segmented control UI using Nextcloud CSS variables for a native look

This follows the industry-standard approach (RFC 8058, Microsoft Actionable Messages): GET requests should never perform state-changing actions. Google Calendar, Zimbra, SOGo, and Baikal all avoid GET-based accept/decline — they use .ics attachments and iMIP instead.

Test plan

• Click accept link in invitation email → confirmation page shown with "Accept" preselected
• Click decline link in invitation email → confirmation page shown with "Decline" preselected
• Click "Save" on confirmation page → invitation response processed correctly
• Verify email link scanners (Safe Links) no longer trigger accept/decline via GET
• Verify the "More options" flow still works as before

[come-nc]

Sounds crazy to me to have an email client click all the links in all emails.
It feels a bit sad to worsen the experience of everyone because of this.
But I do not know enough about the industry standards spoken about to judge. I will let colleagues more familiar with email and calendar give their opinions.

Regarding the content of the PR, the block of styling in the template should be removed, the page should just use the same styling as similar pages.

[Sam428-png]

Thanks for the review! Inline styles are removed, it now reuses the existing schedule-response.css.

About the Safe Links issue — yeah it's a frustrating situation. But it's pretty standard across enterprise mail environments (Exchange ATP, Barracuda, Mimecast etc.) to follow all links on delivery. That means any GET endpoint with side effects gets triggered before the user even opens the email. Google Calendar and Outlook deal with this the same way — require a POST for the actual action.

Happy to hear what the email/calendar colleagues think!

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)