External tool does not get a signed URL, for an `allowedApiCall` with a POST request, when issued for a public file

[PaulBoon]

What steps does it take to reproduce the issue?
I am developping an External Tool that is configured for files and as an explore tool, via GET.

  "scope": "file",
  "types": [
    "explore"
  ],
  "toolUrl": "https://dev.ssh.datastations.nl/custom/synth-file-tool.html",
  "contentType": "text/tab-separated-values",
  "httpMethod":"GET",

The callback request works, and I do get URL's that work for doing GET requests on the file or Auxiliary files.
But when I want to create an auxiliary file I get an 'unauthorised' error.
Below the allowedApiCalls fragment I use:

    {
      "name":"uploadAuxFile",
      "httpMethod":"POST",
      "urlTemplate":"/api/v1/access/datafile/{fileId}/auxiliary/synthJson/0.1",
      "timeOut":270
    }

It might be that for explore types signed URL's for POST and PUT are somehow disabled, I would like to have that working, at least for the auxiliary files.
If the curent functionality is expected behaviour by design, and not changed, it should at least be more explicitly mentioned in the documentation.

• When does this issue occur?
  When the file I am 'running' the tool on is publicly available, so not restricted and not in Draft.

So for restricted and Draft it works, which beats the idea that it would be missing because I am not supposed to mutate stuff while 'exploring'.

• What happens?
  The signedUrl value contains jsut a normal URL

• What did you expect to happen?
  I expected a real signed URL, at least for my POST request, which now does not work.

Which version of Dataverse are you using?
version 6.9

[qqmyers]

FWIW: I suspect we just check if a file is released and not restricted and don't sign anything in that case. We should probably sign PUT/POST/DELETE anyway in that case, at least for 'Config' tools if not all tools (one could argue that Explore tools aren't supposed to write).