Whitelist 'edit_post' and 'upload_files' caps for attachment upload

Both appear to be required in the WP post workflow. See async-upload.php.

See #354
Attachment strings should be localized along with attachment script

There are apparently some cases where the attachment scripts can be loaded
without the main bp-docs-js, so it's best to load the string separately too.

Fixes #417