added APIs: attachments/upload, attachments/download

## Overview

Added APIs to handle attachment files.

## Limits

- All attachment files are **PUBLIC**.  This means that any user can access attachment files who knows URL.
- **ONLY** Authorized users can upload attachment files.
- Anybody **CANNOT** remove uploaded files

## API

### POST /attachments/upload
Upload any files to atmos.
The request is **Multipart**.
#### arguments
1. [requires] attachment_file : input type=file
#### returns
1. status : `ok` if upload was success, `error` if failed 
2. _id : an identifier of uploaded attachment

### GET /attachments/download
Download uploaded files from atmos.
#### arguments
1. [requires] **id** : the identifier assigns to attachment file to be downloaded
2. [optional] **image_width** : assigns image's maximum width if the attachment file is `jpg` or `png`.
3. [optional] **image_height** : assigns image's maximum height if the attachment file is `jpg` or `png`.
##### **image_width** and **image_height** is enabled when you set together

#### returns
Returns the attachment file's binary data.
Returns the **resized** image's binary data when you set **image_width** and **image_height**.

## Requirements
attachment/download requires nginx's functions.
* enable http-image-filter-module
* directory {base}/uploaded/images must allow to access directly
* directory {base}/uploaded/etc must allow to access directly

## Remarks

**Diff** of `main/net/http/request_info.js` is little strange.  I extracted logic handles common header and cookies,  but **Diff** is not so...