Make attachment data available under public by default

Assuming access rights are correctly configured, this allows providing
downloads for any attachment type, not just to display images via
/website/image.