Disallow direct access of orphaned assets

Originally, we used to require that you access an asset through the dandiset and version it belonged to. For a while now, we've had an endpoint for accessing assets directly, via their asset ID. However, this leads to a situation where you can easily access an orphaned asset, which can be misleading, as you might assume it's an "active" asset. We also intend to garbage collect orphaned assets, which would prevent access to that asset anyways.

I think we should either update the direct asset endpoint to only return assets that have an associated version (and thus would 404 on orphaned asset access), or return some other 4xx level response.

@yarikoptic @satra Do you know of anyone that make significant use of orphaned assets?

No file or test is named in the issue. Start by locating the direct asset endpoint and checking how it handles assets without an associated version; review existing API tests for direct asset access. Done means orphaned assets no longer return a successful response, using either a 404 or another agreed 4xx response.

Written by the indexing model from the issue text.