download attachment

- attachment are in scope of project, so every user who has access to
  project can download attachment from that project. Task attachment
  also should link to action project/showAttachment/