Wrong permissions applied to upload plugin

[soupette]

Describe the bug

The permissions applied to the upload plugin settings is incorect. In order to update the ML’s settings the user should only need the plugins::upload.settings.read permission and currently it’s bind to plugins::upload.assets.read.

Steps to reproduce the behaviour

1. Create a dummy role with a just the permissions to access the settings page:

{ action: 'plugins::upload.settings.read', subject: null }

2. Create a dummy user that has the dummy role
3. Try to update the settings of the ML
4. See the forbidden error
5. Add the { action: 'plugins::upload.read', subject: null } permission to its role
6. Now you can update the settings

Expected behavior
The permissions should be this one : { action: 'plugins::upload.settings.read', subject: null }

System

• Node.js version: 12
• NPM version: 6
• Strapi version: latest

Additional context:

There is no work to do on the admin 😉