ir.attachment: revise the access control code, let it be overriden
ir.attachment: revise the access control code, let it be overriden

There was a fundamental problem when a user, through the 'document' module
would try to write into his personal folder; the res.users model won't be
writable by normal users. So, have all this code in a _single_ function,
which will be redefined by document.

Also follow the v6 API for access control, don't just lookup at ir.model.access.

xrg/openerp-server,xrg/openerp-server