Only allow picture attachments from gallery

* Read from URI input stream to handle non-file URIs
* Pictures from camera stored in attachment directory