Finish work on attachment permissions of issue (#24623)

There is a long-standing patchwork that implements permissions and restrictions for issue attachments #24623. We would like to have this patch accepted upstream. Currently, it requires tests and a "bit" of pushing upstream. We would like to pay for this.