Editor: Support editable attachments

[goldpbear]

Shareabouts attachments do not have a PUT endpoint or a visible property, making it impossible to update their visibility settings from the map interface.

To support editable attachments, we'd like to:

• Give attachment models a visible property
• Add a PUT endpoint that can be used to update this property

[goldpbear]

@Lukeswart I've spent some time exploring what it would take to make attachments editable. I think there are two options:

• We could add an AttachmentInstanceView to the api, similar to what submissions have. If done correctly, I think this would give us the ability to reference individual attachments the same way we can reference individual comments and supports. But there's a lot to figure out along the way, such as how to handle permissions and access correctly, as you pointed out.
• Alternatively, we could treat our image attachments not as attachments in the way the api conceives of them, but rather as just another form of a "submitted thing", akin to a comment or a support. This would also give us the ability to reference individual attachments, for example at a url like places/45/uploads/4. The advantage of this approach is that we'll be able to inherit the permissions checks that are already in place for all submitted things, and we'll be able to make use of the PUT and DELETE endpoints that already exist for submitted things. The disadvantage is that we'll probably have to migrate all of our existing attachments data (stored in a separate table in the database) into the submitted things table. This would involve mapping the filename field in the attachments table into the JSON data blob in the submitted thing table, among possibly other changes.

So one approach involves significant modifications to the api but not data migrations; the other involves minimal changes to the api but necessitates a data migration. Let me know if you have thoughts one way or the other--I'm inclined to go with the second approach above, because it has minimal impact on the api codebase.