Freeze a pinned version as the public copy #7938

Task Summary

Part of #7828. With a version pinned, a workflow has two copies. This routes every read that
serves a viewer without granted access through the frozen one, and freezes the title and the
description with the graph.

• The seam — WorkflowAccessResource.hasGrantedAccess(wid, uid): granted access, as
  opposed to being able to read a workflow only because it is public. Owner, shared user and
  project member keep tracking the author's latest, because sharing is not publishing.
• WorkflowPublishService.publicCopyOf returns name, description and content as a group,
  so no surface can pick up the published graph under a title the author has not published.
• Title and description freeze with the graph. They are as public as the graph is: if only
  the graph froze, a report about a title could be answered by editing the title while the
  pinned copy still advertised it.
• Routed through it — opening a workflow, the hub's read of a public workflow, Clone,
  Duplicate, /workflow_name, /workflow_description, and the size a listing shows.

A workflow that follows the author's latest — every workflow today — is served exactly what it
is served now.

Covered by WorkflowPublishSpec: the published version reaching a stranger while the author
keeps their own; a collaborator tracking the author's latest as they keep editing; clone and
duplicate taking the published copy including its name and description; a private workflow
still cloning its working copy; the size of each case; and a public copy of a workflow that is
not public being refused rather than falling through.

Task Type

• Refactor / Cleanup
• DevOps / Deployment / CI
• Testing / QA
• Documentation
• Performance
• Other