Relax permissions for API list room endpoint

[johannaengland]

Dependent on #3376.

Needed for room map widget. The frontend is using the room/ API endpoint.

This bug was introduced in c2b9002

[lunkwill42]

I think I would rather see RelaxedPermission extended to also require the request operation to be a one of the "safe" operations, rather than have custom permission switching code within each view.

DRF provides a IsAuthenticatedOrReadOnly permission which nearly fits the bill. I would want RelaxedPermission to be more like a IsAuthenticatedAndReadOnly. Perhaps even have it renamed to RelaxedReadPermission.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 0.00%. Comparing base (6c75212) to head (a6f8a4b).
Report is 2 commits behind head on 5.13.x.

Additional details and impacted files

@@      Coverage Diff       @@
##   5.13.x   #3375   +/-   ##
==============================
==============================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The base branch was changed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud