Added an empty but required 'attachments' field

This is to work with Zotero v4.0.17.
Rebased zotero patch on top of v4.0.17
Added note about security implication of the patch