Add message index to attachment files

So that files attached to different messages with the same name and
url_part don't get overwritten.
No need to set permissions on file now.

Either rails or the webserver will be sending it, we're not redirecting
anymore.
Add some upgrade notes.
Use 403, not 410, for hidden items.

As @mhl points out, this more clearly indicates that they may come back
at some point.