`StoryAttachment`s belong to the user creating them

Add `user_id` to the `story_attachments` table and assign the `user` property when creating a new `StoryAttachment` instance. This makes it possible to only permit `User`s who created a `StoryAttachment` to delete them.