Require developer or maintainer permissions for seeing confidential bugs

Right now everyone being a reporter in a project is able to see confidential bugs, which is nuts.

We should require either developer or maintainer level to be able to do so.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information