Share every picture with everyone signed in

A profile photo, a bot's picture and a workspace's picture all come from
one condition now (sharedPictureMediaSql), so a face is never blank just
because its owner isn't in the viewer's rail. Anything that isn't a
picture stays behind its own check.

src/functions/server/media/handle-media-server.ts

@@ -16,9 +16,9 @@ type Params = {
  *
  * There is no public media. Every URL is private, so the request has to be
  * signed in and the user has to reach the file (`grabUserMedia` decides
- * that: their own upload, a bot's or workspace's file or picture they can
- * chat with, a file on one of their tasks). Anything else is answered with
- * a 404, never with the file.
+ * that: their own upload, any profile photo, bot picture or workspace
+ * picture, a bot's or workspace's file they can reach, a file on one of
+ * their tasks). Anything else is answered with a 404, never with the file.
  */
 export default async function handleMediaServer({
     req,