Figure out how to permit publicly querying featured images when attachment is assigned to a private post #1987

Given two posts, A (public) and B (private), core currently lets a user assign a featured image to A which has been uploaded to B. However, the REST API's permissions model is such that the featured image can't be queried unless B is public. A unauthenticated client expects to be able to query a featured image assigned to a published post, regardless of which post it was uploaded to.

From #1526 (comment)