Reports can access and download job artifacts despite use of settings to prevent it

Summary

When setting a job to use artifacts:access:developer, reporters can still download and browser pipeline artifacts on a private project. This is especially true if you have the direct link to the artifact pathing via the UI

Changing the setting to artifacts:public:false works as intended, but the previous permission is cached for a good bit, still allowing reporters to be able to download and browser pipeline artifacts on a private project.

Steps to reproduce

  1. create private project
  2. setup simple CI/CD that generates an artifact
  3. have the artifact declaration use access: developer
  4. Run the pipeline
  5. Have a reporter access the job and see the links
  6. have a reporter use the direct links to the artifact pathing
  7. Switch the CI file to use public: false on the artifact declaration
  8. Run a new job
  9. Have reporter try all the same on the new job

Example Project

Don't have currently, one can be created if needed (but due to the quick swapping needed to test it, probably better to be done by the replicator)

What is the current bug behavior?

Reports can still access and job artifacts

What is the expected correct behavior?

Reports should not be able to do so

Relevant logs and/or screenshots

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes

cc @gitlab-com/gl-security/appsec