fix: allow regular users to push files (#4500)

- As part of merging support for Template RBAC
  and user groups a permission check on reading files
  was relaxed.

  With the addition of admin roles on individual templates, regular
  users are now able to push template versions if they have
  inherited the 'admin' role for a template. In order to do so
  they need to be able to create and read their own files. Since
  collisions on hash in the past were ignored, this means that a regular user
  who pushes a template version with a file hash that collides with
  an existing hash will not be able to read the file (since it belongs to
  another user).

  This commit fixes the underlying problem which was that
  the files table had a primary key on the 'hash' column.
  This was not a problem at the time because only template
  admins and other users with similar elevated roles were
  able to read all files regardless of ownership. To fix this
  a new column and primary key 'id' has been introduced to the files
  table. The unique constraint has been updated to be hash+created_by.
  Tables (provisioner_jobs) that referenced files.hash have been updated
  to reference files.id. Relevant API endpoints have also been updated.

coderd/database/dump.sql

@@ -151,7 +151,8 @@ CREATE TABLE files (
     created_at timestamp with time zone NOT NULL,
     created_by uuid NOT NULL,
     mimetype character varying(64) NOT NULL,
-    data bytea NOT NULL
+    data bytea NOT NULL,
+    id uuid DEFAULT gen_random_uuid() NOT NULL
 );
 
 CREATE TABLE gitsshkeys (
@@ -270,10 +271,10 @@ CREATE TABLE provisioner_jobs (
     initiator_id uuid NOT NULL,
     provisioner provisioner_type NOT NULL,
     storage_method provisioner_storage_method NOT NULL,
-    storage_source text NOT NULL,
     type provisioner_job_type NOT NULL,
     input jsonb NOT NULL,
-    worker_id uuid
+    worker_id uuid,
+    file_id uuid NOT NULL
 );
 
 CREATE TABLE site_configs (
@@ -432,7 +433,10 @@ ALTER TABLE ONLY audit_logs
     ADD CONSTRAINT audit_logs_pkey PRIMARY KEY (id);
 
 ALTER TABLE ONLY files
-    ADD CONSTRAINT files_pkey PRIMARY KEY (hash);
+    ADD CONSTRAINT files_hash_created_by_key UNIQUE (hash, created_by);
+
+ALTER TABLE ONLY files
+    ADD CONSTRAINT files_pkey PRIMARY KEY (id);
 
 ALTER TABLE ONLY gitsshkeys
     ADD CONSTRAINT gitsshkeys_pkey PRIMARY KEY (user_id);