Support restricted thumbnails

[ybnd]

References

Add references/links to any related issues or PRs. These may include:

• Fixes #1579

Description

Show restricted Bitstream thumbnails for logged in users that have the permissions to view them.

• Try to show the thumbnail's /content first (this is same behavior as before)

  By assuming that most thumbnails would not be restricted we can avoid having to check permissions when it's not necessary.

• If a thumbnail was resolved from a Bitstream but couldn't be shown

  • Check if the user is logged in (if not, fall back to default)
  • Check if the user is authorized to view the thumbnail (if not, fall back to default)
  • Retry with a short-lived token

Some changes in order to make transitions between failed & successful images more smooth:

• Hide the <img> with d-none instead of *ngIf so it can fetch the image while it's hidden
• Start out with the loading animation playing by default
• Stop it once an image is successfuly loaded or when falling back to the HTML placeholder (for non-restricted thumbnails this is quite quick)

Instructions for Reviewers

1. Find (or create) a DSO with a restricted thumbnail
2. Open a page where that thumbnail would be displayed (e.g. a DSO page, a search page in grid mode, ...)
3. Log out
   • The thumbnail should not appear
4. Log in as an EPerson that has no access to the thumbnail
   • The thumbnail should not appear
5. Log in as an EPerson that has access to the thumbnail
   • The thumbnail should appear

Checklist

This checklist provides a reminder of what we are going to look for when reviewing your PR. You need not complete this checklist prior to creating your PR (draft PRs are always welcome). If you are unsure about an item in the checklist, don't hesitate to ask. We're here to help!

• [x] My PR is small in size (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
• [x] My PR passes TSLint validation using yarn run lint
• [x] My PR doesn't introduce circular dependencies
• [x] My PR includes TypeDoc comments for all new (or modified) public methods and classes. It also includes TypeDoc for large or complex private methods.
• [ ] My PR passes all specs/tests and includes new/updated specs or tests based on the Code Testing Guide.
• [x] If my PR includes new, third-party dependencies (in package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.