Don't display public activity by default when requiring consent

Just as we mentioned in the previous commit, there are places where we
aren't sure whether explicit consent is strictly required. So, when the
"require consent" setting is enabled, we're taking the safe approach.
This means that, in this case, we're only displaying a user's activity
if they've given explicit consent.

spec/factories/users.rb

@@ -7,7 +7,6 @@ FactoryBot.define do
     terms_of_service    { "1" }
     confirmed_at        { Time.current }
     date_of_birth       { 20.years.ago }
-    public_activity     { true }
 
     trait :incomplete_verification do
       after :create do |user|

spec/models/user_spec.rb

@@ -146,6 +146,20 @@ describe User do
       end
     end
 
+    describe "#public_activity" do
+      it "is true by default when the consent for notifications setting is disabled" do
+        Setting["feature.gdpr.require_consent_for_notifications"] = false
+
+        expect(build(:user).public_activity).to be true
+      end
+
+      it "is false by default when the consent for notifications setting is enabled" do
+        Setting["feature.gdpr.require_consent_for_notifications"] = true
+
+        expect(build(:user).public_activity).to be false
+      end
+    end
+
     describe "#recommended_debates" do
       it "is true by default when the consent for notifications setting is disabled" do
         Setting["feature.gdpr.require_consent_for_notifications"] = false