Fix uploaded attachment placeholder page

At the moment we redirect to the placeholder page for any failure in attachment viewing. This is undesirable as this page returns a 200 due to a quirk in our load balancing, so Google and the redirector don't behave themselves.

This changes the `AttachmentsController` to only redirect if we *know* the file is in `incoming` (i.e is actually being virus checked), and otherwise 404. This has the beneficial side effect of also 404ing for any attachments that a visitor is unauthorised to access.

As part of this I've killed the old `UploadsControllerHelper` code and folded both the attachment controllers into a single hierarchy for simplicity.