filer: mint volume read JWT when proxying chunk reads (#10100)

The /?proxyChunkId= endpoint forwards the caller's headers to the volume
server but never mints a read token, so proxied chunk reads return 401
once jwt.signing.read.key is configured. Generate a fileId-scoped volume
token the same way the direct filer read path does, which fixes
filer.sync, filer.backup, filerProxy mounts, the MQ broker and the upload
gateway in one place.

weed/server/filer_server_handlers_proxy.go

@@ -97,6 +97,11 @@ func (fs *FilerServer) proxyToVolumeServer(w http.ResponseWriter, r *http.Reques
 		}
 	}
 
+	// volume server may require a read JWT even though the proxy endpoint doesn't
+	if jwt := fs.maybeGetVolumeReadJwtAuthorizationToken(fileId); jwt != "" {
+		proxyReq.Header.Set("Authorization", "BEARER "+jwt)
+	}
+
 	proxyResponse, postErr := util_http.GetGlobalHttpClient().Do(proxyReq)
 
 	if postErr != nil {