Article galleys can be downloaded before the article is published if you know the URL

**Describe the bug**
The /article/id/{id}/download/{pdf/xml} URLs are currently allowing unauthenticated users to download a galley even before the article is published

**Janeway version**
v1.5.1


**Expected behavior**
Articles that are not yet published should return a 404 on those URLs
