Protect firmware upload (web interface) but leave open action controls (ie: light on/off)

**Describe the problem you have/What new integration you would like**

**Please describe your use case for this integration and alternatives you've tried:**

**Additional context**

I read that authentication will be added to the web_server component. (actually I already saw the merge)
The idea of that feature was to protect the firmware upload!!!!

Unfortunately this authentication will protect the upload, but will prevent "guest" users to turn on or off the light for instance.
The authentication should protect only the upload, or alternative, there could be an option to choose, to protect all or only the firmware upload. Using the web interface to call actions by guest users is very useful!

Analogously, if you have guest, you do want them to be able to turn on and off light, clima, etc, but you do not want them to open the switches and alter the cabling inside the walls :)

No files or tests are named. Start by reviewing the web_server authentication behavior described in the request, then trace how firmware upload and guest action controls are exposed. Done means authentication protects firmware upload while guests can still use light, climate, and similar action controls.

Written by the indexing model from the issue text.