web: reject worker tokens from web views

Ayush Sharmarequested to merge
ayushHardeniya/debusine:1410/worker-tokens-rejection into devel

Workers are generally expected to use the API rather than the web UI. the known exception is DownloadPathView, which workers use to download artifacts.

Add an allow_worker_tokens flag to BaseUIView, defaulting to False, and enable it for DownloadPathView.

also add a test covering the default rejection of worker tokens in web views

fixes: #1410 (closed)

Merge request reports