Allow download schemes to support but not require authentication

* If the current user is unauthenticated and the scheme requires
  authentication, don't list it.

* If the patch is not visible to anonymous users and the scheme
  does not support authentication, don't list it.

In particular, since https on googlesource.com supports but does not
require authentication, this should allow the https download links to
be shown again on private changes on that gerrit instance (like they
were before ea62148983a4cee7ed0e44593a1926782372a768).

Change-Id: Icf3177c0f90062df4d3264375a6a6035251b91cf
2 files changed