R1:2896da384cb7

Only require POST to fetch file data if the viewer is logged in

Summary:
Ref T11357. In D17611, I added `file.search`, which includes a `"dataURI"`. Partly, this is building toward resolving T8348.

However, in some cases you can't GET this URI because of a security measure:

- You have not configured `security.alternate-file-domain`.
- The file isn't web-viewable.
- (The request isn't an LFS request.)

The goal of this security mechanism is just to protect against session hijacking, so it's also…