[change] Improve endpoints to download firmware images

[nemesifier]

Right now, the API endpoint which shows the image information, has a field, called "file", which links to the private-storage view.
But we also have an API endpoint to download the firmware, although it's implemented differently than the private storage view.

It also looks that the private storage view does not check if the user has "view permission" on the object. So it would be theoretically possible that a staff user without premissions to view firmware images can still download the firmware image, which is a problem.

Therefore, I think we should do the following things:

• Find a way to call openwisp_firmware_upgrader.private_storage.views.FirmwareImageDownloadView from openwisp_firmware_upgrader.api.views.FirmwareImageDownloadView, to avoid duplicating logic
• Change the file attribute of FirmwareImageSerializer to point to the API URL (because API supports token authentication (we need a test that ensures the new URL is not the one generated by private_storage)
• Ensure the private storage view checks whether the user has the view permission on FirmwareImage objects (we need a test for this), once this is done, we can try to set permission_classes to an empty list on the API FirmwareImageDownloadView, to avoid checking permissions twice, in theory it should work