Encode attachment IDs

I found that if I saved an attachment with an id including `?` then the revision query parameter wouldn't be recognised and I'd get a 409 conflict. I know, a silly thing to do, but perhaps we should be escaping attachment IDs anyway?

In this pull request, attachment IDs are URL encoded, _except_ slashes `/`, so people can continue to upload attachments like `path/to/index.html`.