feat: split authentication tags since replies have required data field (unlike submissions) (planning#460)

and since attachment is now used in two places, extract it into a "part" for DRY reasons