rc: flip auth default so all endpoints require auth unless opted out

Replace AuthRequired bool with NoAuth bool on the rc.Call struct and
flip the auth check logic. Previously endpoints were unauthenticated
by default and had to opt in with AuthRequired: true, which led to
security vulnerabilities when developers forgot to set the flag.

Now all endpoints require authentication by default. Only explicitly
safe read-only endpoints are marked with NoAuth: true:

- rc/noop
- rc/error
- rc/list
- core/version
- core/stats
- core/group-list
- core/transferred
- core/du
- cache/stats
- vfs/list
- vfs/stats
- vfs/queue
- job/status
- job/list

See GHSA-25qr-6mpr-f7qx, GHSA-jfwf-28xr-xw6q

cmd/bisync/rc.go

@@ -18,11 +18,10 @@ import (
 
 func addRC() {
 	rc.Add(rc.Call{
-		Path:         "sync/bisync",
-		AuthRequired: true,
-		Fn:           rcBisync,
-		Title:        shortHelp,
-		Help:         rcHelp,
+		Path:  "sync/bisync",
+		Fn:    rcBisync,
+		Title: shortHelp,
+		Help:  rcHelp,
 	})
 }