Add API for creating, editing and deleting user-owned file attachments.

This is part of a set of changes to add support for dragging and dropping
images into the Markdown editor.

This change creates an API for working with user file attachments. They can be
accessed at /api/users/<username>/file-attachments/<id>/, and can only be
accessd or manipulated by the owner (or admin) for security reasons (we don't
want people to be able to access a file attachment containing sensitive
information uploaded to a private review request).

User-owned file attachments can be created without any associated file data, in
order to reserve a URL that can be inserted into a text field. The data can
then be uploaded in a separate PUT request. Once data is uploaded, it cannot be
changed.

The BaseFileAttachmentResource has been split up a bit, with parts going into
BaseReviewRequestFileAttachment. This helps to keep all core file attachment
API logic in one place.

Reviewed at https://reviews.reviewboard.org/r/6617/