api: event stream should allow topic without filter

.changelog/27065.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Fixed a bug in the Go API where an event stream request without a topic filter would require a management token
+```

api/event_stream.go

@@ -181,6 +181,10 @@ func (e *EventStream) Stream(ctx context.Context, topics map[Topic][]string, ind
 
 	// Build topic query params
 	for topic, keys := range topics {
+		if len(keys) == 0 {
+			r.params.Add("topic", fmt.Sprintf("%s", topic))
+			continue
+		}
 		for _, k := range keys {
 			r.params.Add("topic", fmt.Sprintf("%s:%s", topic, k))
 		}

api/event_stream_test.go

@@ -66,21 +66,40 @@ func TestTopic_String(t *testing.T) {
 func TestEvent_Stream(t *testing.T) {
 	testutil.Parallel(t)
 
-	c, s := makeClient(t, nil, nil)
+	c, s, _ := makeACLClient(t, nil, nil)
 	defer s.Stop()
 
+	aclPolicy := ACLPolicy{
+		Name:  "read-events-policy",
+		Rules: `namespace "default" { policy = "read" }`,
+	}
+	_, err := c.ACLPolicies().Upsert(&aclPolicy, nil)
+	must.NoError(t, err)
+
+	at := c.ACLTokens()
+	tokenSpec := &ACLToken{
+		Name:     "read-events-token",
+		Type:     "client",
+		Policies: []string{"read-events-policy"},
+	}
+	token, _, err := at.Create(tokenSpec, nil)
+	must.NoError(t, err)
+
 	// register job to generate events
 	jobs := c.Jobs()
 	job := testJob()
 	resp2, _, err := jobs.Register(job, nil)
 	must.NoError(t, err)
 	must.NotNil(t, resp2)
 
+	// downscope our client
+	c.SetSecretID(token.SecretID)
+
 	// build event stream request
 	events := c.EventStream()
 	q := &QueryOptions{}
 	topics := map[Topic][]string{
-		TopicEvaluation: {"*"},
+		TopicEvaluation: {},
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())