Attachment upload with nonexistent relationship is allowed

Summary

It is possible to create attachments which link to a nonexistent dataset/sample/proposal/published_data.

Steps to Reproduce

Create an attachment:

POST api/v4/attachments
{'caption': 'An attachment', 'ownerGroup': 'group1', 'relationships': [{'targetId': 'nonexistent-id', 'targetType': 'dataset', 'relationType': 'is attached to'}], 'accessGroups': ['group1'], 'isPublished': False, 'thumbnail': 'data:image/png;base64,OTI3OGM3OGE5MDRqaA=='}

This returns 200 with created attachment including an aid. Then

GET api/v4/attachments/{aid}

This now returns the attachment created above.

This also works when 'relationships' is empty.

Current Behaviour

The API allows creating 'dangling' attachments that are not attached to anything.

Expected Behaviour

The API should return an error if there are no relationships or the relationships point to an object that does not exist.
This would help avoid mistakes from pasting a bad ID into a relationship.

Start at the POST api/v4/attachments endpoint and reproduce the requests in the issue, including an empty relationships array and a nonexistent targetId. Trace the attachment relationship validation and add or update coverage so invalid or missing relationships return an error; done means dangling attachments cannot be created while valid relationships still work.