Only request write when necessary

- Only request write for `INTERNAL_TOKEN_URI` when no token was found.
- Resolves go-gitea#18655

modules/setting/setting.go

@@ -1080,7 +1080,7 @@ func loadInternalToken(sec *ini.Section) string {
 	}
 	switch tempURI.Scheme {
 	case "file":
-		fp, err := os.OpenFile(tempURI.RequestURI(), os.O_RDWR, 0o600)
+		fp, err := os.OpenFile(tempURI.RequestURI(), os.O_RDONLY, 0o400)
 		if err != nil {
 			log.Fatal("Failed to open InternalTokenURI (%s): %v", uri, err)
 		}
@@ -1092,6 +1092,12 @@ func loadInternalToken(sec *ini.Section) string {
 		}
 		// No token in the file, generate one and store it.
 		if len(buf) == 0 {
+			fp.Close()
+			fp, err = os.OpenFile(tempURI.RequestURI(), os.O_WRONLY, 0o600)
+			if err != nil {
+				log.Fatal("Failed to open InternalTokenURI (%s): %v", uri, err)
+			}
+
 			token, err := generate.NewInternalToken()
 			if err != nil {
 				log.Fatal("Error generate internal token: %v", err)