`/api/authz/features/<:string>`: contract says admin-only, backend allows anonymous access

[MMilosz]

Please describe your request
Features.md states that /api/authz/features/<:string> is "restricted to system administrators"[1], but any unauthenticated user can access it[2] as backend uses permitAll()[3]. It also describes return codes 401 Unauthorized & 403 Forbidden[4]

[1]

RestContract/features.md

Lines 19 to 22 in 54bcdf6

	## Single Feature
	**/api/authz/features/<:string>**
	Provide detailed information about a specific feature. Access is restricted to system administrators. The JSON response document is as follow

[2]
https://sandbox.dspace.org/server/api/authz/features/canDownload

[3]
https://github.com/DSpace/DSpace/blob/f9fe9434c24305e811d79da6b121b96b974c7731/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/AuthorizationFeatureRestRepository.java#L51-L59

[4]

RestContract/features.md

Lines 42 to 43 in 54bcdf6

	* 401 Unauthorized - if you are not authenticated
	* 403 Forbidden - if you are not logged in with sufficient permissions. Only system administrators can access

[lgeggleston]

Hi @MMilosz, thanks for submitting this! I think we may need some additional context for working on a fix though.

First, could you put this description into the format for a bug report?
Second, would your proposed fix be to update the RestContract to reflect the unrestricted access, or instead make sure it's actually restricted to administrators on the backend (depending on the use case for this endpoint)? We can also wait for more input from the community if unsure. Thank you!