Enforce Desk User read permissions on attachments

Hide the add attachment button from users without write access.