[client] Refuse --upload-bundle-insecure only when an upload is requested

A request with no URL, no upload and uploadInsecure set was denied, although
uploadInsecure has no effect on a local-only bundle: there is no destination to
weaken, and the caller only wanted the file on disk. Pass the upload intent into
the gate and apply the empty-URL branch only when the request asks to upload.

Reported by cubic on #7514.

client/server/debug_gate_test.go

@@ -111,6 +111,7 @@ func TestRequirePrivilegeForUploadURL(t *testing.T) {
 		name     string
 		url      string
 		insecure bool
+		noUpload bool
 		unprivOK bool
 		invalid  bool
 		rootAlso bool
@@ -119,6 +120,8 @@ func TestRequirePrivilegeForUploadURL(t *testing.T) {
 		// An empty URL resolves to the destination management published, so
 		// relaxing TLS towards it needs the same privilege as naming a host.
 		{name: "insecure with no URL", url: "", insecure: true, rootAlso: true},
+		// insecure only weakens an upload; a local-only bundle must still pass.
+		{name: "insecure with no URL and no upload", url: "", insecure: true, noUpload: true, unprivOK: true},
 		{name: "default service", url: types.DefaultBundleURL, unprivOK: true},
 		{name: "default service, other path", url: "https://upload.debug.netbird.io/other", unprivOK: true},
 		{name: "loopback exfiltration endpoint", url: "https://127.0.0.1:8080/upload-url", rootAlso: true},
@@ -137,7 +140,7 @@ func TestRequirePrivilegeForUploadURL(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			err := requirePrivilegeForUploadURL(userCtx(), tc.url, tc.insecure)
+			err := requirePrivilegeForUploadURL(userCtx(), tc.url, tc.insecure, !tc.noUpload)
 
 			switch {
 			case tc.invalid:
@@ -153,7 +156,7 @@ func TestRequirePrivilegeForUploadURL(t *testing.T) {
 			}
 
 			if tc.rootAlso {
-				assertAllowed(t, requirePrivilegeForUploadURL(rootCtx(), tc.url, tc.insecure))
+				assertAllowed(t, requirePrivilegeForUploadURL(rootCtx(), tc.url, tc.insecure, !tc.noUpload))
 			}
 		})
 	}