implement permissions for image attach module

There's no user permissions supplied at all by this module.
I think there should be some, but I'm interested to hear whether what others think they should be.

My suggestion would be:

- 'attach images' for whether the user can pick an image node to attach or change the attached image
- use the 'create image content' to determine whether a user may upload a new image

Is a distinction needed between picking an image node to attach and changing an existing attachment?

I'll do a patch once we figure out what we want :)