Block listing children of upload-only folder on GET request

[VicDeo]

Description

Block listing children of upload-only folder on GET request

Related Issue

• Fixes [new public webdav] public can download file from upload-only folder if filename is known #36076

Motivation and Context

It should not be possible to read files in upload-only folder

How Has This Been Tested?

Steps to reproduce
share a folder as "Upload Only" as public link
download a file from that folder using the new webdav public link api

curl --silent \
http://owncloud/remote.php/dav/public-files/Upload_Folder_Share_Token/Path_To_the_File \
-H 'X-Requested-With:XMLHttpRequest' \
-H "Range:bytes=0-150" \
-X GET

Expected behaviour

download should not be possible (404)

Actual behaviour

download is possible

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

Open tasks:

• Backport (if applicable set "backport-request" label and remove when the backport was done)

[codecov]

Codecov Report

Merging #36119 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master   #36119   +/-   ##
=======================================
  Coverage      54%      54%           
=======================================
  Files          63       63           
  Lines        7403     7403           
  Branches     1308     1308           
=======================================
  Hits         3998     3998           
  Misses       3019     3019           
  Partials      386      386

Flag	Coverage Δ
#javascript	54% <ø> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 98922f1...dc9a72f. Read the comment docs.

[codecov]

Codecov Report

Merging #36119 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master   #36119   +/-   ##
=======================================
  Coverage      54%      54%           
=======================================
  Files          63       63           
  Lines        7403     7403           
  Branches     1308     1308           
=======================================
  Hits         3998     3998           
  Misses       3019     3019           
  Partials      386      386

Flag	Coverage Δ
#javascript	54% <ø> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4aa17f5...cbd4705. Read the comment docs.

[jvillafanez]

Code looks fine, assuming it works and tests pass