The submissions API is blocking submission download of submissions for challenges that a user doesn't have access to (like a copilot opening up another copilot's challenge in WM), but we still show the download button.

Instead, let's block this so it doesn't even attempt to download. When loading a challenge, we should look at the resources array for the challenge, and if the logged in user is in the resources API, then they can see the download buttons, but if they aren't in the resources array, we'll hide the download button.