default read-only access via TCP port 8086 in influxdb1.x, read/write actions via unix socket

__Proposal:__
I would like to be able (in influxdb 1.x, and preferably also in 2.x) to configure read rights on the TCP socket and read/write rights on the unix-socket interface (see discussion #23229) without having to set-up users.

For security reasons it makes sense to make this the default behavior, such that the exposed influx TCP port does not allow remote tampering with the databases (i.e. write access). This tampering can also happen from private addresses, e.g. when 127.0.0.1:8086 is port-forwarded to another machine with e.g. ssh. Most of the time, mainly read access is required remotely, e.g. for using influxdb datasource in grafana dashboards.

Programmatically this behavior may be implemented by having different handler/service authentication properties for unix sockets and TCP port.

__Current behavior:__
When I currently start with both TCP and unix socket enabled, they will both have the same authentication behavior, as configured in the configuration file.
```
# auth-enabled = false
#auth-enabled = true
unix-socket-enabled = true
bind-socket = "/var/run/influxdb/influxdb.sock"
```
I.e. when auth-enabled is true, both `influx -socket /var/run/influxdb/influxdb.sock ` and `influx -host localhost -port 8086` will need to authenticate to get anything done.

__Desired behavior:__
I would like the unix-socket interface to be allowed read/write access based on the users that are added to the influxdb group in /etc/group. This would allow both programs like telegraf and the influx commandline to work for the configured users without having to set-up any influxdb specific credentials.
I would like the TCP interface (normally port 8086), to deny writing operations unless authentication is enabled.

__Alternatives considered:__
Setting up credentials for reading and writing on each IoT device with a influxdb, but in my case this needs to be maintained both on each IoT device, for our sensor code, for telegraf, and for each datasource in grafana. This quickly becomes a maintenance nightmare.

__Use case:__

- Disabling default write access makes influxdb 1.x much more secure.
- Remote write access may not be required in many cases, e.g. when using influxdb datasource in grafana.
- Default read/write access for influxdb group members via the unix socket allows easy writing to the database for local processes
- Splitting read/write access for local and read access for remote users alleviates the burden to maintain credentials in a multitude of places (for local as well as remote access for e.g. grafana datasources).
- Not needing credentials locally prevents leaking them via configuration files for telegraf, other influxdb library programs, etc.
- The influx cmdline over unix socket may provide an easier and more secure way to reset the admin credentials. I.e. without requiring root access to toggle the auth-enabled configuration, restarting the daemon, fixing, toggling again and restarting the daemon. During the fixing stage all data may be exposed/remotely vulnerable.

Start by reviewing the existing authentication configuration for the TCP port and Unix socket, then read discussion #23229 for the related design context. Done should provide read-only TCP access unless authentication is enabled, while allowing the requested local Unix-socket read/write behavior without separate credentials.

Written by the indexing model from the issue text.