Use an unguessable filename for all file attachment uploads.

FileAttachments now save with an unguessable filename. They contain the
real filename, but with a UUID prepended. This serves a couple purposes.

1) People can't guess/scan for common names.
2) Users can't craft malicious filenames with the intent to mess up an
   unsecured installation (such as naming a file .htaccess).

The original filename is stored in the database, which is useful for
display purposes. We never actually present the resulting filename
except in the HTML for linking/display.

The caption is now set to the filename by default, so there isn't
necessarily this weird "caption OR filename" thing. It's a sane default
that users can see and override.
Merge branch 'release-1.6.x' into release-1.7.x
Release Review Board 1.6.18.
Merge branch 'release-1.6.x' into release-1.7.x
Fix the list of dependencies.

These got messed up during a merge. We're now back at the proper 1.7.x
dependency list, plus an update for Djblets 0.7.16.
Don't add the new header if the review request doesn't have a repository.

The recent change to add a X-ReviewRequest-Repository header for e-mails
broke for review requests without a repository. It's now conditionally
added.