Finish the bulk upload loop

This adds the create action, which is the final stage of a bulk
upload. It either saves the attachments to the edition or renders
form errors. Still a few holes to fill:

  * Appropriate errors when a file is of a non-whitelisted type
  * form fields for attachments with additional meta data
  * Authorisation based on the restrictions on the edition