On List page, "Attach issues" is shown for users with read-only access

[dregad]

When a Changeset is not linked to any issue, the List page displays a text field and an Attach button as a shortcut to link issues without having to go to the View Changeset page (see #224).

Problem is, the input form is also shown when user does not have privileges to update Changesets. Note that this does not actually allow attaching Issues - access control correctly prevents that.