Fix release draft access check logic (#36720)

1. remove hasRepoWriteScope to avoid abuse
2. clarify "ctx.Written" behavior
3. merge "read-only" tests to slightly improve performance

routers/api/v1/repo/release_attachment.go

@@ -34,13 +34,9 @@ func checkReleaseMatchRepo(ctx *context.APIContext, releaseID int64) bool {
 		ctx.APIErrorNotFound()
 		return false
 	}
-	if release.IsDraft {
-		if !canAccessDraftRelease(ctx) {
-			if !ctx.Written() {
-				ctx.APIErrorNotFound()
-			}
-			return false
-		}
+	if release.IsDraft && !canAccessReleaseDraft(ctx) {
+		ctx.APIErrorNotFound()
+		return false
 	}
 	return true
 }
@@ -149,13 +145,9 @@ func ListReleaseAttachments(ctx *context.APIContext) {
 		ctx.APIErrorNotFound()
 		return
 	}
-	if release.IsDraft {
-		if !canAccessDraftRelease(ctx) {
-			if !ctx.Written() {
-				ctx.APIErrorNotFound()
-			}
-			return
-		}
+	if release.IsDraft && !canAccessReleaseDraft(ctx) {
+		ctx.APIErrorNotFound()
+		return
 	}
 	if err := release.LoadAttributes(ctx); err != nil {
 		ctx.APIErrorInternal(err)