ipn/localapi: only require read access to list file targets

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

ipn/localapi/localapi.go

@@ -300,8 +300,8 @@ func (h *Handler) serveFiles(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) serveFileTargets(w http.ResponseWriter, r *http.Request) {
-	if !h.PermitWrite {
+	if !h.PermitRead {
-		http.Error(w, "file access denied", http.StatusForbidden)
+		http.Error(w, "access denied", http.StatusForbidden)
 		return
 	}
 	if r.Method != "GET" {