Create config setting to optionally disable DICOM downloads

[johnsaigle]

While creating the Open PREVENT-AD instance of LORIS, it was important to disable the disable of DICOM files out of concern for privacy and to fulfill the study's ethical commitments.

This was done in an ad-hoc way and it would probably benefit future studies going open to have a configuration option that would optionally disable DICOM downloads.

The PR linked below indicates all the places in LORIS where this can be done.

https://github.com/johnsaigle/Loris/pull/16

TODO:

• Create a config setting in the 0000-00-00 table enableDICOMDownload with a default of true.
  • Also a corresponding patch in SQL/New_patches
• For each place in LORIS where downloading DICOMs is possible, check if the above setting is false
• If so, disable/hide all UI elements allowing download
• The file htdocs/mri/jiv/get_file.php should check this config setting and return a 403 response when DICOM files are requested. This must be done in case a user tries to access the files directly even when UI elements allowing this are not shown in LORIS.
• DICOM download must also be disabled via the API. I'm not sure where this takes place but it should also give a 403 if the setting is disabled.
• Update Raisinbread files

[xlecours]

Adding a check in the handle function of modules/api/php/endpoints/candidate/visit/dicoms.class.inc would cover restrictions on the API.
If this feature is implemented as a permission, add a _hasAccess function in the endpoint (see modules/api/php/endpoints/candidates.class.inc for an example)
If it is a configuration, then we still have to make a static call to \NDB_Factory::singleton()->config()

[johnsaigle]

That's a good idea. I was thinking about a config setting but it would be much better to use a permission so that it could be tied to specific users.