CVE-2022-31134: Exclude private attachments from realm exports.
CVE-2022-31134: Exclude private attachments from realm exports.

Zulip Server 2.1.0 and above have a UI tool, accessible only to server
owners and server administrators, which provides a way to download a
“public data” export. While this export tool is only accessible to
administrators, in many configurations server administrators are not
expected to have access to private messages and private
streams. However, the “public data” export which administrators could
generate contained the attachment contents for all attachments, even
those from private messages and streams.

Signed-off-by: Anders Kaseorg <dfdb7392591db597bc41cf266a9c3bc12a2706e5@zulip.com>

andersk/zulip,rht/zulip,zulip/zulip,andersk/zulip,rht/zulip,andersk/zulip,andersk/zulip,rht/zulip,zulip/zulip,andersk/zulip,rht/zulip,zulip/zulip,rht/zulip,rht/zulip,zulip/zulip,zulip/zulip,andersk/zulip,zulip/zulip,andersk/zulip,rht/zulip,zulip/zulip