restrict verifiers to public file links in calendar event export

test plan:
* create a calendar event for a private course with a link
to an unlocked attachment
* sync the calendar with an external source
* the exported calendar event should not add a verifier to
the link (and thus allow someone to bypass authentication)

* repeat for a public course
* should add a verifier this time

closes #CNVS-15352

Change-Id: I743e73dc852c204cdf68c0b8b9e3fc2d402ad855
Reviewed-on: https://gerrit.instructure.com/43288
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>