window.ipfs ACL should match the http read-only / gateway API

[olizilla]

go-ipfs exposes a subset of the API to the gateway as a public / read-only version of the regular API. The white list we use for window.ipfs should be derived from that list, if it isn't already.

Current definition of the read-only api https://github.com/ipfs/go-ipfs/blob/727bf49eff7ff61936aee6d4674ae3e7ad0aaddb/core/commands/root.go#L155-L187

[lidel]

I like the idea of having the source of truth for this somewhere else, "Public API exposed on Gateway port" feels like a good match.

That being said, right now, the lack of add on the list makes this proposal bit problematic.
If dapps are unable to add data over window.ipfs, why would anyone use it?
Is there an upstream issue for go-ipfs about changing defaults or making this list configurable?

[lidel]

Closing due to #589 (comment)