Ship-It does not allow to download some XPIs

[bakulf]

Recently, we promoted cpmanager and cehomepage XPIs, but when I try to download the XPIs, I see this error message:

This request requires Taskcluster credentials that satisfy the following scope expression:\n\n```\n{\n "AllOf": [\n "queue:get-artifact:xpi/build/cehomepage.xpi"\n ]\n}\n```\n\n---\n\n* method: getLatestArtifact\n* errorCode: InsufficientScopes\n* statusCode: 403\n* time: 2025-10-14T18:01:56.836Z

[bhearsum]

For clarity, this is from https://shipit.mozilla-releng.net/xpi. Some links work fine, eg: for this china-newtab we get https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/FjScj3a_T3eoPfabsH3b2Q/artifacts/public%2Fbuild%2Fchina-newtab.xpi, and the download works:

Links to private artifacts do not appear to work, eg: for cehomepage we get: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/XGN4sefOSJ-MFF7pd6xkhw/artifacts/xpi%2Fbuild%2Fcehomepage.xpi

We can download that artifact just fine from https://firefox-ci-tc.services.mozilla.com/tasks/XGN4sefOSJ-MFF7pd6xkhw, though. Clicking that link includes a bewit query param, which is presumably why that works.

If Ship It is able to generate bewit params we should be including those. If not, we should find an alternate link for private artifacts (eg: perhaps linking to the task instead of the artifact).