Fix API endpoint permission for the "AttachmentMixin" class (#3218)

* Fix API endpoint permission for the "AttachmentMixin" class

- Any authenticated user could perform CREATE and UPDATE operations on attachments
- Could be performed via the browsable DRF API
- Could also be performed via the front-end (with some advaned jiggering of OPTIONS code)

* Show or hide buttons depending on the permissions of the user

* Add shortcut for table permission check

InvenTree/templates/attachment_table.html

@@ -2,7 +2,7 @@
 
 <div id='attachment-buttons'>
     <div class='btn-group' role='group'>
-        <div class='btn-group'>
+        <div class='btn-group' id='multi-attachment-actions'>
             <button class='btn btn-primary dropdown-toggle' type='button' data-bs-toggle='dropdown' title='{% trans "Actions" %}'>
                 <span class='fas fa-tools'></span> <span class='caret'></span>
             </button>