feat(12.2-01): add deferred bindings, guarded upload store and purge

- deferred_bindings migration set under summercms.deferred with backend_user_id
- lagoon.DeferredBind/Unbind/Bindings/Forget/Slaves scoped by DeferredKey
- lagoon.PurgeDeferred with SKIP LOCKED batches and after-commit blob deletes
- attach.Store with the ported image guard, extension and MIME limits
- attach.Relation, attach.HasRelations, attach.BlobKeys, File.ThumbKey
- lagoon README and attachments docs

modules/lagoon/attach/relation.go

@@ -0,0 +1,21 @@
+package attach
+
+// Relation declares one WinterCMS attachOne or attachMany relation of an
+// Owner model. Name is the relation name stored in system_files.field, Many
+// is true for attachMany (false for attachOne), and Public decides the
+// is_public flag of files stored through the relation: a protected relation
+// (Public false) stores is_public=false rows, for which the framework never
+// builds a public URL.
+type Relation struct {
+	Name   string
+	Many   bool
+	Public bool
+}
+
+// HasRelations is implemented by an Owner model that declares its
+// attachment relations, the Go form of WinterCMS's $attachOne and
+// $attachMany arrays. A form field that edits attachments must name one of
+// the declared relations.
+type HasRelations interface {
+	AttachRelations() []Relation
+}