SECURITY: only allow picking of avatars created by self (#6417)

* SECURITY: only allow picking of avatars created by self

Also adds origin tracking to all uploads including de-duplicated uploads

spec/lib/upload_creator_spec.rb

@@ -22,6 +22,18 @@ RSpec.describe UploadCreator do
         expect(upload.extension).to eq('txt')
         expect(File.extname(upload.url)).to eq('.txt')
         expect(upload.original_filename).to eq('utf-8.txt')
+        expect(user.user_uploads.count).to eq(1)
+        expect(upload.user_uploads.count).to eq(1)
+
+        user2 = Fabricate(:user)
+
+        expect do
+          UploadCreator.new(file, "utf-8\n.txt").create_for(user2.id)
+        end.to change { Upload.count }.by(0)
+
+        expect(user.user_uploads.count).to eq(1)
+        expect(user2.user_uploads.count).to eq(1)
+        expect(upload.user_uploads.count).to eq(2)
       end
     end