rc: flip auth default so all endpoints require auth unless opted out

Replace AuthRequired bool with NoAuth bool on the rc.Call struct and
flip the auth check logic. Previously endpoints were unauthenticated
by default and had to opt in with AuthRequired: true, which led to
security vulnerabilities when developers forgot to set the flag.

Now all endpoints require authentication by default. Only explicitly
safe read-only endpoints are marked with NoAuth: true:

- rc/noop
- rc/error
- rc/list
- core/version
- core/stats
- core/group-list
- core/transferred
- core/du
- cache/stats
- vfs/list
- vfs/stats
- vfs/queue
- job/status
- job/list

See GHSA-25qr-6mpr-f7qx, GHSA-jfwf-28xr-xw6q

vfs/rc.go

@@ -361,8 +361,9 @@ func rcPollInterval(ctx context.Context, in rc.Params) (out rc.Params, err error
 
 func init() {
 	rc.Add(rc.Call{
-		Path:  "vfs/list",
-		Title: "List active VFSes.",
+		Path:   "vfs/list",
+		NoAuth: true,
+		Title:  "List active VFSes.",
 		Help: `
 This lists the active VFSes.
 
@@ -393,8 +394,9 @@ func rcList(ctx context.Context, in rc.Params) (out rc.Params, err error) {
 
 func init() {
 	rc.Add(rc.Call{
-		Path:  "vfs/stats",
-		Title: "Stats for a VFS.",
+		Path:   "vfs/stats",
+		NoAuth: true,
+		Title:  "Stats for a VFS.",
 		Help: `
 This returns stats for the selected VFS.
 
@@ -441,8 +443,9 @@ func rcStats(ctx context.Context, in rc.Params) (out rc.Params, err error) {
 
 func init() {
 	rc.Add(rc.Call{
-		Path:  "vfs/queue",
-		Title: "Queue info for a VFS.",
+		Path:   "vfs/queue",
+		NoAuth: true,
+		Title:  "Queue info for a VFS.",
 		Help: strings.ReplaceAll(`
 This returns info about the upload queue for the selected VFS.