luci-app-banip: fix ACL for non-root users

Three related ACL defects:

* The frontend reads the feed, category and list files as well as the
  runtime information via fs.read_direct(), which is served by cgi-io's
  download handler. That handler requires the "cgi-io"/"download" scope,
  which was not granted, so all of these requests failed with a 403 for
  non-root sessions.

* The custom feed import uses ui.uploadFile(), which is served by
  cgi-io's upload handler and requires the "cgi-io"/"upload" scope in
  the write section. It was missing as well.

* All file entries lived in the write section, including the read-only
  ones. Since rpcd pulls a section in via the matching list in
  /etc/config/rpcd, a session holding only "list read luci-app-banip"
  had no read access to any of the files at all. Move the read
  permissions to the read section and keep only the write permissions in
  the write section.

The effective permission set of a session holding both lists is
unchanged.

Signed-off-by: Dirk Brenken <dev@brenken.org>

applications/luci-app-banip/Makefile

@@ -7,7 +7,7 @@ LUCI_TITLE:=LuCI support for banIP
 LUCI_DEPENDS:=+luci-base +banip
 
 PKG_VERSION:=1.8.10
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_LICENSE:=Apache-2.0
 PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
 

applications/luci-app-banip/root/usr/share/rpcd/acl.d/luci-app-banip.json

@@ -2,43 +2,48 @@
 	"luci-app-banip": {
 		"description": "Grant access to LuCI app banIP",
 		"write": {
+			"cgi-io": [
+				"upload"
+			],
 			"uci": [
 				"banip"
 			],
 			"file": {
-				"/etc/banip/*": [
-					"read"
-				],
 				"/etc/banip/banip.allowlist": [
-					"read",
 					"write"
 				],
 				"/etc/banip/banip.blocklist": [
-					"read",
 					"write"
 				],
 				"/etc/banip/banip.custom.feeds": [
-					"read",
 					"write"
 				],
 				"/var/run/banIP/banIP.search": [
-					"read",
 					"write"
 				],
 				"/var/run/banIP/banIP.report": [
-					"read",
 					"write"
 				]
 			}
 		},
 		"read": {
 			"cgi-io": [
+				"download",
 				"exec"
 			],
 			"file": {
+				"/etc/banip/*": [
+					"read"
+				],
 				"/var/run/banIP/banIP.runtime.json": [
 					"read"
 				],
+				"/var/run/banIP/banIP.search": [
+					"read"
+				],
+				"/var/run/banIP/banIP.report": [
+					"read"
+				],
 				"/usr/sbin/nft -tj list sets": [
 					"exec"
 				],