[FIX] ir_attachment: restrict access to orphan attachments to employees