send user_image only on public lti launches

test plan:
  - change a tool's privacy level to anonymous
  - tool launch should not have user_image
  - change a tool's privacy level to public
  - tool launch should have user_image

fixes PLAT-708

Change-Id: Iccca705fd3e5c5385ae63897e49d9c67d46f62d7
Reviewed-on: https://gerrit.instructure.com/43633
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
Reviewed-by: Bracken Mosbacker <bracken@instructure.com>
QA-Review: August Thornton <august@instructure.com>

Author: wbhumphrey

gems/lti_outbound/lib/lti_outbound/tool_launch.rb

@@ -69,7 +69,6 @@ def generate(overrides={})
       hash['resource_link_id'] = link_code
       hash['resource_link_title'] = overrides['resource_link_title'] || tool.name
       hash['user_id'] = user.opaque_identifier
-      hash['user_image'] = user.avatar_url
       hash['text'] = CGI::escape(selected_html) if selected_html
 
       hash['roles'] = user.current_role_types # AccountAdmin, Student, Faculty or Observer
@@ -86,6 +85,7 @@ def generate(overrides={})
         hash['lis_person_contact_email_primary'] = user.email
       end
       if tool.public?
+        hash['user_image'] = user.avatar_url
         hash['custom_canvas_user_id'] = '$Canvas.user.id'
         hash['lis_person_sourcedid'] = user.sis_source_id if user.sis_source_id
         hash['custom_canvas_user_login_id'] = '$Canvas.user.loginId'