serverutil/perm: only permit the storage user to list references
serverutil/perm: only permit the storage user to list references

The previous behavior was to allow any store writer to list references,
which leaks information unnecessarily. Only the storage user (the
administrator) has a need to list references, so narrow the access.

Change-Id: I923b8cf8dad8b4fac8983740e4baef0452e2fb74
Reviewed-on: https://upspin-review.googlesource.com/17180
Reviewed-by: Rob Pike <4dc7c9ec434ed06502767136789763ec11d2c4b7@golang.org>

upspin/upspin,upspin/upspin