Only allow email attachments inside of EMAIL_ATTACHMENT_ROOT

This can limit the scope of vulnerabilities created by incorrect escaping in YAML templates. This could be backwards incompatible if you are including attachments outside of `EMAIL_ATTACHMENT_ROOT`, but I don't think anyone is doing this.