Decide guest grants explicitly instead of by permission name

guest_grantable_permissions() opened any permission whose name ended
'.view' or '.read' to the guest role, on the reasoning that reading is
the safe default. That is true of a permission gating a list of asset
numbers and false of one gating bytes, and a suffix cannot tell them
apart. Twenty-four of eighty-five qualified and none had been decided:

  applications.view  reached the SYSTEM-context PowerShell bodies and
                     the installer binaries pushed to bays
  backups.view       returned the full payload that the separate
                     backups.download permission exists to protect
  assets.view        gated a global search that queries the staff
                     directory, USB history and network inventory with
                     no per-domain check of its own
  audit.view         usernames, addresses, the before/after of every
  settings.view      change, and every setting row - both admin
                     category, opened by naming alone
  users.view         gates nothing at all; list_users is
                     require_role('admin')

Every entry is now declared, by CORE_GUEST_GRANTABLE or by the plugin
that owns the permission, having read what its routes actually return.
Adding one is a code change, which is the point: it puts the decision
in a diff rather than in a suffix.

The two routes serving script bodies and installer packages move to a
new applications.download permission, which is not grantable, so a site
can still open the catalogue metadata to its floor without the bytes
going with it.

The declared set preserves the grants this site had already chosen:
applications.view, computers.view, endpoints.view, reports.view,
tools.secrets, warranty.view.

Two known gaps are recorded on the hooks that expose them rather than
silently carried: the computer serializer publishes every column plus
resolved rdp:// and vnc:// links, and the per-asset endpoint panels are
keyed on a small integer so walking ids reconstructs much of the roster
that endpoints.fleet exists to protect. Neither is widened here.

A shipped test was granting guests audit.view and passing.

Scope: product
(cherry picked from commit 347402896c)

shopdb/core/api/users.py

@@ -351,19 +351,20 @@ def update_role(roleid: int):
     # Update permissions
     if 'permissions' in data and role.rolename != 'admin':
         # The guest role is anyone with no account, so what it may hold is
-        # bounded: reads, plus the handful of writes a plugin has explicitly
-        # declared safe to do anonymously. Refused at the door rather than
-        # warned about - a checkbox that quietly makes deleting an asset
-        # anonymous is not a warning anybody reads twice.
+        # bounded to what core or a plugin has explicitly declared grantable.
+        # Refused at the door rather than warned about - a checkbox that
+        # quietly makes deleting an asset anonymous is not a warning anybody
+        # reads twice.
         if role.rolename == Role.GUEST:
             allowed = guest_grantable_permissions()
             refused = sorted(set(data['permissions']) - allowed)
             if refused:
                 return error_response(
                     ErrorCodes.VALIDATION_ERROR,
-                    'The guest role cannot hold {}. A guest may be granted any '
-                    'view permission, and only writes a plugin has declared '
-                    'safe to do without an account.'.format(', '.join(refused)))
+                    'The guest role cannot hold {}. A guest may only be '
+                    'granted permissions core or the owning plugin has '
+                    'declared grantable, which is a code change rather than a '
+                    'setting.'.format(', '.join(refused)))
         old_perms = [p.name for p in role.permissions]
         perms = Permission.query.filter(Permission.name.in_(data['permissions'])).all()
         new_perms = [p.name for p in perms]