ServeAttachment checks perm.CanRead(unitType) which fails for
licensed read-only access on private repos. Now skips the check
when LicensedReadOnly is set in context (from RepoAssignment).
This allows Joomla/WordPress clients with valid dlid= params to
download release files from private licensed repos.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>