Private attachment access setting

Projects can now disable public attachment access and require authenticated access for attachment files. This goes hand in hand with our get attachment file endpoint that we shipped last week.