Reject access to group/project avatar if the user doesn't have access.

Closes #2050.

I'll add tests for EE logos once this is merged here and merged into EE.

See merge request !1671