fix(client): upload an attachment through the root that checked it

[willkg]

Closes #186.

The converter checked each image through the documentation root's os.Root, but the checksum and the upload then opened it by absolute path. That made three lookups, and only the first was bounded. A directory on the path replaced by a symlink between the check and the upload could make markfluence upload a file from outside the root, which S2 (no-read-outside-root) rules out. The plan is _plans/052_upload-through-the-root.md, including what the code review changed.

What changed

• Opening through the root. LocalAttachment carries the root (json:"-", so check --show-html --json and the schema are unchanged) and an Open method, which the checksum and the upload both use. With a root, Open opens Source through it. After opening, it looks up the name again and refuses a symlink, or a name that is no longer the opened file. os.Root blocks escapes but follows a symlink that stays inside the root, and markfluence follows no symlinks, so without this a link swapped in at an image's name could publish an in-root .env under that name.
• attachment-upload. It sets no root, because its files come from the command line rather than from a Markdown reference, and --name lets them live anywhere.
• Regular files only. The open is non-blocking and the opened file must be a regular file, so a FIFO or directory swapped in is refused instead of hanging the upload.
• Error wording. An escape is reported as "outside the documentation root", the converter's wording, not os.Root's bare error.
• Checksums that match what was sent. The upload reads the whole file and writes the checksum of the bytes it actually sends into the attachment's comment. Before, the comment recorded the checksum from planning time, so a file changed in between got a comment that didn't describe its content.

Not changed

When a batch of uploads stops partway, the result still omits the uploads that landed before the failure. That predates this PR and is left alone.

Tests

• Open refuses:
  • an escape through a symlinked directory created after the root was opened;
  • a relative symlink inside the root;
  • a FIFO and a directory.
• Open without a root opens the file's path.
• SyncAttachments fails on an escape and uploads nothing.
• An upload of a file changed after planning carries the new bytes with their own checksum.
• The converter sets the root on image attachments.
• make check passes.