rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176

The options/set RC endpoint was registered without AuthRequired,
allowing unauthenticated callers to mutate global runtime options
including rc.NoAuth, which disables the auth gate for all protected
RC methods. Require authentication for options/set.

See GHSA-25qr-6mpr-f7qx

fs/rc/config.go

@@ -146,9 +146,10 @@ func rcOptionsLocal(ctx context.Context, in Params) (out Params, err error) {
 
 func init() {
 	Add(Call{
-		Path:  "options/set",
-		Fn:    rcOptionsSet,
-		Title: "Set an option",
+		Path:         "options/set",
+		AuthRequired: true,
+		Fn:           rcOptionsSet,
+		Title:        "Set an option",
 		Help: `Parameters:
 
 - option block name containing an object with