server: replace admin checks with VIEWCLUSTERMETADATA and REPAIRCLUSTERMETADATA

[rafiss]

Release note (security update): Endpoints in the admin and status server
that previously required the admin role now can be used by users with
the VIEWCLUSTERMETADATA or REPAIRCLUSTERMETADATA system privilege,
depending on whether the endpoint is read-only or can modify state.

fixes #79571
fixes #109814
Release note: None

[blathers-crl]

It looks like your PR touches production code but doesn't add or edit any test code. Did you consider adding tests to your PR?

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is 

[dhartunian]

with some minor comments.

Reviewed 8 of 8 files at r1, 1 of 8 files at r2.
Reviewable status: complete! 1 of 0 LGTMs obtained (waiting on @ecwall, @rafiss, and @Santamaura)

---

-- commits line 10 at r2:
does this need to have a release note noting the security change that allows the new fine-grained permissions?

---

pkg/server/status.go line 3637 at r1 (raw file):

	// if !isAdmin {
	// 	return nil, privchecker.ErrRequiresAdmin
	// }

nit: remove this?

[rafiss]

Reviewable status: complete! 1 of 0 LGTMs obtained (waiting on @dhartunian, @ecwall, and @Santamaura)

---

-- commits line 10 at r2:

Previously, dhartunian (David Hartunian) wrote…

does this need to have a release note noting the security change that allows the new fine-grained permissions?

i think the release note would be redundant with the one above and the one i added in #110084 so i opted to put no note here. i can put that in the commit message though.

---

pkg/server/status.go line 3637 at r1 (raw file):

Previously, dhartunian (David Hartunian) wrote…

nit: remove this?

thanks for the catch!

[rafiss]

TFTR!

bors r+

[craig]

Build succeeded:

• Bazel Essential CI (Cockroach)

[blathers-crl]

Encountered an error creating backports. Some common things that can go wrong:

1. The backport branch might have already existed.
2. There was a merge conflict.
3. The backport branch contained merge commits.

You might need to create your backport manually using the backport tool.

---

error creating merge commit from 499bbe0 to blathers/backport-release-23.1-110609: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict []

you may need to manually resolve merge conflicts with the backport tool.

Backport to branch 23.1.x failed. See errors above.

---

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}