Download permission per object, not only per role

[oreinaud]

Problem

Today "Download Files" is one switch per role, and it covers every file in the workspace. We can't say "this role may download commercial offers, but not contracts". We have to either block every download or allow sensitive files to be downloaded too.

Example

Our sales team should download the PDF offers they send to clients (files on our "CDR offer" object). They should only preview signed contracts (files on our "Contract" object), not download them. One switch per role can't express this.

Proposal

1. Add a "Download files" box next to Read / Update / Delete in each object's permissions within a role. The role's general "Download Files" switch stays as the default.
2. Files, notes and tasks linked to a record follow the download rule of that record's object. A file on a Contract follows the Contract rule. Attachments, notes and tasks already take their visibility from their parent record (inherited readability), so download could follow the same path.
3. In the new record-sharing feature, add "can download files" as an option when sharing a record. One contract could then be shared as "view only" and another as "view and download".
4. Check the rule on the server when the file is served, not only by hiding the button. Today the file link works for anyone who holds it, for one day, whatever their role.