Add write-only mode

Output of rest-server --version

rest-server 0.9.7 compiled with go1.10 on linux/amd64

What should rest-server do differently?

Currently we've --append-only mode that tries to minimize risks of access to repo by attacker from compromised host.

So there is no way to remove data from repo. But there is still a way to 'restore' whatever attacker wants from --append-only repo.

It would be great to also have --write-only like option to completely disable read access to data subdir. I know that restic may need it during backup, but it's actually not strictly required: usually parent snapshot is already cached. And when not cached, it's still possible to perform slower backup with --force option that don't need that snapshot at all. Ideally restic should be aware of such write-only repo and automatically fallback to --force but not necessary.

Start by tracing how rest-server handles the existing --append-only mode and access to the data subdir. Check how restic backup reads from a repository and how --force changes that behavior. Done means a write-only option prevents read access while still allowing the intended backup requests, with appropriate tests for both permitted and denied access.