Fix hg anonymous access by sending authenticate header

If anonymous access is enabled and read requests are granted
to hg repositories for the anonymous user, write requests
fail also for users with write requests, because no
authentication header has been sent along with the 401.
This fixes this issue in the default cgi servlet.

gradle/changelog/hg_anonymous_mode.yaml

@@ -0,0 +1,2 @@
+- type: fixed
+  description: Broken HG write access when anonymous users have read access

scm-webapp/src/main/java/sonia/scm/web/cgi/DefaultCGIExecutor.java

@@ -36,6 +36,7 @@ import org.slf4j.LoggerFactory;
 
 import sonia.scm.SCMContext;
 import sonia.scm.config.ScmConfiguration;
+import sonia.scm.security.Authentications;
 import sonia.scm.util.HttpUtil;
 import sonia.scm.util.IOUtil;
 import sonia.scm.util.SystemUtil;
@@ -444,7 +445,11 @@ public class DefaultCGIExecutor extends AbstractCGIExecutor
     if (status < 304) {
       response.setStatus(status);
     } else {
-      response.sendError(status);
+      if (status == 401 && Authentications.isAuthenticatedSubjectAnonymous()) {
+        HttpUtil.sendUnauthorized(response, configuration.getRealmDescription());
+      } else {
+        response.sendError(status);
+      }
     }
   }