media assets: fix md5 leak in media assets.

Fix unprivileged users being able to see images and MD5 hashes of media
assets belonging to censored posts.

app/policies/media_asset_policy.rb

@@ -4,4 +4,16 @@ class MediaAssetPolicy < ApplicationPolicy
   def index?
     true
   end
+
+  def can_see_image?
+    record.post.blank? || record.post.visible?(user)
+  end
+
+  def api_attributes
+    if can_see_image?
+      super
+    else
+      super.excluding(:md5)
+    end
+  end
 end