locking: use a download token when searching locks

The locking API documentation specifies that a user need only have pull
access to the repository when searching locks. However, we requested an
upload token, which requires push access. Instead, ask for a download
token, which requires only pull access, as documented.

locking/api.go

@@ -180,7 +180,7 @@ type lockList struct {
 }
 
 func (c *lockClient) Search(remote string, searchReq *lockSearchRequest) (*lockList, *http.Response, error) {
-	e := c.Endpoints.Endpoint("upload", remote)
+	e := c.Endpoints.Endpoint("download", remote)
 	req, err := c.NewRequest("GET", e, "locks", nil)
 	if err != nil {
 		return nil, nil, err

t/t-locks.sh

@@ -50,6 +50,33 @@ begin_test "list a single lock"
 )
 end_test
 
+begin_test "list a single lock (SSH)"
+(
+  set -e
+
+  reponame="locks-list-ssh"
+  setup_remote_repo_with_file "$reponame" "f.dat"
+  clone_repo "$reponame" "$reponame"
+
+  sshurl="${GITSERVER/http:\/\//ssh://git@}/$reponame"
+  echo $sshurl
+  git config lfs.url "$sshurl"
+
+  git lfs lock --json "f.dat" | tee lock.log
+
+  id=$(assert_lock lock.log f.dat)
+  assert_server_lock "$reponame" "$id" "refs/heads/master"
+
+  GIT_TRACE=1 git lfs locks --path "f.dat" 2>trace.log | tee locks.log
+  cat trace.log
+  [ $(wc -l < locks.log) -eq 1 ]
+  grep "f.dat" locks.log
+  grep "Git LFS Tests" locks.log
+  grep "lfs-ssh-echo.*git-lfs-authenticate $reponame download" trace.log
+)
+end_test
+
+
 begin_test "list a single lock (--json)"
 (
   set -e