enhance create_attachment policy

these are purely policy changes but require code to be written in resource_registry. please review.

current policy only allows attachment to orgs, UserInfo, and resources that have an "hasResource" association with a relevant org,