Downloading an attachment should re-check access on the parent record

Attachment download URLs often get minted once and stay valid for a long time. The server signed a path when the user could read the ticket, then never looked again. Later that person loses access, or