Only allow lobby scope to see featured mod files

Author: Sheikah45

src/main/java/com/faforever/api/featuredmods/FeaturedModsController.java

@@ -1,12 +1,14 @@
 package com.faforever.api.featuredmods;
 
 import com.faforever.api.data.domain.FeaturedMod;
+import com.faforever.api.security.OAuthScope;
 import com.google.common.collect.Maps;
 import com.yahoo.elide.jsonapi.models.Data;
 import com.yahoo.elide.jsonapi.models.JsonApiDocument;
 import com.yahoo.elide.jsonapi.models.Resource;
 import io.swagger.annotations.ApiOperation;
 import org.springframework.scheduling.annotation.Async;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
@@ -31,6 +33,7 @@ public FeaturedModsController(FeaturedModService featuredModService) {
   @Async
   @RequestMapping(path = "/{modId}/files/{version}")
   @ApiOperation("Lists the required files for a specific featured mod version")
+  @PreAuthorize("hasScope('" + OAuthScope._LOBBY + "')")
   public CompletableFuture<JsonApiDocument> getFiles(@PathVariable("modId") int modId,
                                                      @PathVariable("version") String version,
                                                      @RequestParam(value = "page[number]", required = false) Integer page) {