operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179

The operations/fsinfo RC endpoint was registered without AuthRequired,
allowing unauthenticated callers to instantiate arbitrary backends via
inline backend definitions.

See GHSA-jfwf-28xr-xw6q

fs/operations/rc.go

@@ -430,9 +430,10 @@ func rcPublicLink(ctx context.Context, in rc.Params) (out rc.Params, err error)
 
 func init() {
 	rc.Add(rc.Call{
-		Path:  "operations/fsinfo",
-		Fn:    rcFsInfo,
-		Title: "Return information about the remote",
+		Path:         "operations/fsinfo",
+		AuthRequired: true,
+		Fn:           rcFsInfo,
+		Title:        "Return information about the remote",
 		Help: `This takes the following parameters:
 
 - fs - a remote name string e.g. "drive:"