kvs-watch: allow guests to access module stats

Problem: flux module stats is generally open to guests,
but the RPC override in the kvs-watch module is not.

Open kvs-watch.stats-get to guests.
Add a test to t1005-kvs-security.t.

Author: garlick

src/modules/kvs-watch/kvs-watch.c

@@ -1075,7 +1075,7 @@ static const struct flux_msg_handler_spec htab[] = {
     { .typemask     = FLUX_MSGTYPE_REQUEST,
       .topic_glob   = "kvs-watch.stats-get",
       .cb           = stats_cb,
-      .rolemask     = 0
+      .rolemask     = FLUX_ROLE_USER
     },
     { .typemask     = FLUX_MSGTYPE_REQUEST,
       .topic_glob   = "kvs-watch.lookup",

t/t1005-kvs-security.t

@@ -298,6 +298,12 @@ test_expect_success 'kvs: stats works (user)' '
         unset_userid
 '
 
+test_expect_success 'kvs-watch: stats works (user)' '
+        set_userid 9999 &&
+        flux module stats kvs-watch >/dev/null &&
+        unset_userid
+'
+
 test_expect_success 'kvs: stats clear fails (user)' '
         set_userid 9999 &&
         ! flux module stats -c kvs &&