Don't display public activity by default when requiring consent

Just as we mentioned in the previous commit, there are places where we
aren't sure whether explicit consent is strictly required. So, when the
"require consent" setting is enabled, we're taking the safe approach.
This means that, in this case, we're only displaying a user's activity
if they've given explicit consent.

app/models/user.rb

@@ -1,7 +1,7 @@
 class User < ApplicationRecord
   include Verification
   attribute :registering_from_web, default: false
-  %i[newsletter email_digest email_on_direct_message recommended_debates
+  %i[newsletter email_digest email_on_direct_message public_activity recommended_debates
      recommended_proposals].each do |field|
     attribute field, :boolean, default: -> { !Setting["feature.gdpr.require_consent_for_notifications"] }
   end