Public spaces cannot be read without an account

Problem

Currently the simple spaces implementation allows spaces to be marked as public, however this simply allows any authenticated user to get read access to the space, this excludes unauthenticated users.

There are a number of cases where content will start gated behind a closed space but then become public content or vice versa. In these cases requiring a user to have a valid DID / PDS and be able to mint a delegation token is not only unnecessary but it closes off certain public use cases that should be enabled.

Solution

The existing public policy is still useful so I'd proposed a new "unauthenticated" policy. This skips all authentication checks and allows any session to obtain space credentials. If the space credentials are obtained without a valid delegation token then we should consider putting a very long timeout on the space credentials (24 hours?)

The existing space host specification is sufficient for notifying clients about updates to records in the space, we simply need to provide these notifications to users with a space credential.

Describe alternatives you've considered

I've created a space host that is specifically for this: https://tangled.org/chris.pardy.family/public-spaces

However the 1-to-1 relationship between space host and DID means that we can't move a single space into the public / unauthenticated space.

I've also considered the various ways we can move content between spaces or to public data. These are all non-starters for most use cases.

Additional context The public spaces implementation linked above works and is deployed at https://public.chrispardy.dev/

Actual changes are fairly minor but require adding a new permission policy at a lexicon level.