Attachments of public datasets are not public

Issue Name

Attachments of public datasets are not public

Summary

In the old backend attachments of public datasets were displayed on the dataset detail page also to users that are not logged in. With the new backend attachments of public datasets are hidden to users that are not authenticated.

Expected Behaviour

I think that attachments of public datasets should be visible to anyone also without authentication.

Extra Details

I saw that when I query an attachment of a public dataset via /api/v3/datasets/{id}/attachments authentication is required but when using /api/v3/datasets/{id}/thumbnail I can get the image without authentication. This is not consistent in itself.

just for reference here a dump of how my attachment looks like:

  {
    "_id": "0e9b468d-4d53-459e-ad45-75e183b8a303",
    "ownerGroup": "xrr",
    "accessGroups": [
      "xrr"
    ],
    "createdBy": "test",
    "updatedBy": "test",
    "thumbnail": "data:image/png;base64,iVBORw0KGgo...",
    "caption": "xrr curve",
    "datasetId": "PID.SAMPLE.PREFIX2b9c841c-a98c-435c-9d69-5672907a8e7d",
    "__v": 0,
    "id": "0e9b468d-4d53-459e-ad45-75e183b8a303"
  }

Start by comparing the authentication behavior of /api/v3/datasets/{id}/attachments with /api/v3/datasets/{id}/thumbnail for a public dataset. Trace the API access checks and verify that attachment requests work without authentication only when the dataset is public, while private datasets remain protected.