wasi: return NotPermitted for stream open permission failures

[SebTardif]

Summary

read_via_stream, write_via_stream, and append_via_stream returned ErrorCode::BadDescriptor when the descriptor lacked the required read/write permission. The non-stream read / write paths in the same module already return NotPermitted for the same condition.

Why this change is needed

Permission denial should use the permission-denied error code. BadDescriptor maps to a different condition (invalid/wrong kind of FD). Guests that branch on not-permitted vs bad-descriptor currently get the wrong signal when opening a stream view on a file opened without the needed access.

Change

Three sites in crates/wasi/src/p2/host/filesystem.rs:

- Err(types::ErrorCode::BadDescriptor)?;
+ Err(types::ErrorCode::NotPermitted)?;

aligned with:

// async fn read / write
if !f.perms.contains(FilePerms::READ/WRITE) {
    return Err(ErrorCode::NotPermitted.into());
}

Testing

• cargo check -p wasmtime-wasi passes.

[alexcrichton]

Thanks! Could you add a test for this as well?