[FIX] project: access to portal task give access to attachment

If a visitor has access to a task through access_token, he should have
access to the task attachments. He already see the list of attachment
and their name, but since the task access_token is not propagated to the
attachment he doesn't have the rights to see them.

In this PR, we generate the attachments access_token and provide them to
the user that is viewing a task with an access_token.

opw-2125252
closes #41881

closes odoo/odoo#42115

X-original-commit: e7984c49
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>