Quarantine API: extend download call to download whole mails

Quarantine API: extend download call to download whole mails

this makes the attachmentid parameter optional and if it is not
given, open the whole mail for download

The permission check, that a quser only is able to get their own
mails/attachments, happens in get_and_check_mail, thus we can add the
quser to the "sufficient permissions" list without opening up the
real permissions the users has.

[Thomas] add permissions info to commit message

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Tested-By: Stoiko Ivanov <s.ivanov@proxmox.com>
Reviewed-By: Stoiko Ivanov <s.ivanov@proxmox.com>