Nick Craig-Wood
4bb6a1edf6
With --rc-serve set the root listing enumerated the names of all configured remotes without any authentication. Make the root listing obey the same fail-closed rule as the rest of the rc endpoints: it now requires authentication to be configured or an explicit opt out with --rc-no-auth. Addresses GHSA-mfvx-7rcj-9m5g finding 2.