FIX: Do not count deleted post for upload ref security (#19949)

When checking whether an existing upload should be secure
based on upload references, do not count deleted posts, since
there is still a reference attached to them. This can lead to
issues where e.g. an upload is used for a post then later on
a custom emoji.

spec/lib/upload_security_spec.rb

@@ -217,6 +217,16 @@ RSpec.describe UploadSecurity do
         end
       end
 
+      describe "when the upload is first used for a post in a secure context that is later deleted" do
+        it "returns false" do
+          create_secure_post_reference
+          post_in_secure_context.trash!
+          CustomEmoji.create(name: "meme", upload: upload)
+
+          expect(subject.should_be_secure?).to eq(false)
+        end
+      end
+
       describe "when the upload is first used for a site setting" do
         it "returns false" do
           SiteSetting.favicon = upload