OrigDatablocks not returned in dataset public v4

[nitrosx]

Summary

When submitting a GET request to /api/v4/dataset/public/<pid> that includes all of the linked information, it returns the dataset output DTO schema without the origdatablock included.
When viewing the same dataset in the FE as anonymous user, the files list is populated.

Steps to Reproduce

Submit a request similar to the following to your test environment:
curl -X 'GET' \ 'http://localhost:3000/api/v4/datasets/public?filter=%7B%0A%20%20%22limits%22%3A%20%7B%0A%20%20%20%20%22limit%22%3A%202%0A%20%20%7D%0A%7D' \ -H 'accept: application/json'

Copy the pid of the first public dataset shown and submit a request for the specific dataset specifying include all option.

The dataset output dto returned is not fully populated with the origdatablock

Current Behaviour

Currently, it appears that the GET dataset/public/<pid> does not return the origdatablocks associated with the dataset

Expected Behaviour

When requesting a dataset through a GET dataset/public/<pid> with the include all option, it should return a fully populated dataset output dto that include the origdatablock

Details

[nitrosx]

This bug might be linked to #2386

[HayenNico]

I think I've tracked down the cause for this, and that should also be the reason for #2386. Main problem is that isPublished: true must also be set on the relations requested by include - so only OrigDatablocks/Attachments with that set will be shown.
It seems that when setting Datasets to public in the Frontend, this does not update Origdatablocks and Attachments. Needs discussion as to the best approach for solution - to what extent should the relation access controls be synchronized to datasets in the backend?

More detailed breakdown as to where this comes from:

In DatasetsService.addLookupFields there's a call to DatasetsAccessService.addRelationFieldAccess that will add permission filters to each relation lookup regardless of whether the service was called from /api/v4/datasets or /api/v4/dataset/public. For the public endpoint, the difference is that the Authorization header is not set (when using Swagger), so the user will be undefined. That is correctly handled and will push a isPublished: true filter into the lookup pipeline for each relation. But if there is a mismatch where the dataset is published but a relation document is not, that relation will then be filtered out by the lookup pipeline.