fix(webapi): Mask unauthorized attachment URLs in EndUser transmission endpoints (#1890)

<!--- Provide a general summary of your changes in the Title above -->

## Description

EndUser transmission endpoints gives out original URLs when the user is
not authorized to see them

## Related Issue(s)

- #1889 

## Verification

- [x] **Your** code builds clean without any errors or warnings
- [x] Manual testing done (required)
- [ ] Relevant automated test added (if you find this hard, leave it and
we'll help out)

## Documentation

- [ ] Documentation is updated (either in `docs`-directory, Altinnpedia
or a separate linked PR in
[altinn-studio-docs.](https://github.com/Altinn/altinn-studio-docs), if
applicable)

Author: oskogstad

src/Digdir.Domain.Dialogporten.Application/Features/V1/EndUser/DialogTransmissions/Queries/Get/GetTransmissionQuery.cs

@@ -83,7 +83,7 @@ public async Task<GetTransmissionResult> Handle(GetTransmissionQuery request,
 
         if (dto.IsAuthorized) return dto;
 
-        var urls = transmission.Attachments.SelectMany(a => a.Urls).ToList();
+        var urls = dto.Attachments.SelectMany(a => a.Urls).ToList();
         foreach (var url in urls)
         {
             url.Url = Constants.UnauthorizedUri;

src/Digdir.Domain.Dialogporten.Application/Features/V1/EndUser/DialogTransmissions/Queries/Search/SearchTransmissionQuery.cs

@@ -1,4 +1,5 @@
 using AutoMapper;
+using Digdir.Domain.Dialogporten.Application.Common.Authorization;
 using Digdir.Domain.Dialogporten.Application.Common.ReturnTypes;
 using Digdir.Domain.Dialogporten.Application.Externals;
 using Digdir.Domain.Dialogporten.Application.Externals.AltinnAuthorization;
@@ -68,6 +69,21 @@ public async Task<SearchTransmissionResult> Handle(SearchTransmissionQuery reque
             return new EntityDeleted<DialogEntity>(request.DialogId);
         }
 
-        return _mapper.Map<List<TransmissionDto>>(dialog.Transmissions);
+        var dto = _mapper.Map<List<TransmissionDto>>(dialog.Transmissions);
+
+        foreach (var transmission in dto)
+        {
+            transmission.IsAuthorized = authorizationResult.HasReadAccessToDialogTransmission(transmission.AuthorizationAttribute);
+
+            if (transmission.IsAuthorized) continue;
+
+            var urls = transmission.Attachments.SelectMany(a => a.Urls).ToList();
+            foreach (var url in urls)
+            {
+                url.Url = Constants.UnauthorizedUri;
+            }
+        }
+
+        return dto;
     }
 }