Fix upload/new-folder buttons not actually hiding when logged out

.gpx-panel__action's own "display: flex" outranks the browser's
default "[hidden] { display: none }" -- same specificity, but an
author stylesheet rule always beats a user-agent one -- so setting
.hidden = true on these (GpxPanelControl#mount) never had any visual
effect. The per-file row icons (delete/download) were unaffected by
this since they're conditionally never added to the DOM at all rather
than hidden after the fact, a different mechanism that doesn't hit
this bug.

Same class of bug as the earlier Distance/Area overlap fix. Swept the
rest of the app's [hidden]-manipulated elements for the same pattern
(a display override with no [hidden] counterpart) -- this was the
only other one.

Verified in a real browser: computed display is now "none", not just
the hidden attribute being set with no visual effect.

public/css/style.css

@@ -277,6 +277,14 @@ html, body {
   cursor: pointer;
 }
 
+/* This class's own "display: flex" above otherwise wins over the browser
+   default "[hidden] { display: none }" — same specificity, but an author
+   rule always outranks a user-agent one — so GpxPanelControl#mount hiding
+   these (logged out: no upload/new-folder) had no visual effect at all. */
+.gpx-panel__action[hidden] {
+  display: none;
+}
+
 .gpx-panel__action svg {
   width: 18px;
   height: 18px;