How does GetCapabilities() interact with authorization & unknown instance names?

- Assume I have a build cluster that supports writes to the AC, but only to certain users/clients.
- Is it permitted to return `ActionCacheUpdateCapabilities` that has `update_enabled` set to true for some of them, while returning false to ones that are unauthorized? Or should access controls have no influence in this matter?
- Nit: What is the default value of `update_enabled`, in case `action_cache_update_capabilities` in `ActionCacheUpdateCapabilities` is not set? I assume false? Why isn't this boolean embedded into the parent directly?
- Does the same hold for `ExecutionCapabilities`'s `exec_enabled` field?
- What does it mean if this field is not set? That it's unknown whether execution is supported?
- Assume GetCapabilities() is called against an instance name that does not exist. Should an error be returned? If so, which one? `NOT_FOUND` or `INVALID_ARGUMENT`? Or is it allowed to succeed, returning a `ServerCapabilities` that has both `execution_capabilities` and `cache_capabilities` left unset?
- What if the user is not authorized to interact with the instance name? Should we return `PERMISSION_DENIED` errors? This is in my opinion somewhat inconsistent with `exec_enabled` and `update_enabled`, as based on the previous questions those may also be used to convey authorization related decisions.

Long story short, I have the feeling that the semantics of the GetCapabilities() call are underspecified.

Start by reading the definitions and existing documentation for GetCapabilities(), ActionCacheUpdateCapabilities, ExecutionCapabilities, and ServerCapabilities. Compare the unanswered authorization, default-value, and unknown-instance questions with current API behavior. Done means the semantics and expected errors are explicitly documented and the issue's questions are resolved.

Written by the indexing model from the issue text.