Include attachment editing permissions into the Field permissions in the workflow
Currently Redmine does not allow to restrict the modification of attachments in the issues.
Any user can modify the attachments in any way after the issues have been validated and the status has been changed to prevent further edits or limit them to a small number of allowed users.
Including attachment editing in the workflow will enable organizing and defining a more consistent workflow, including attachments which are no possible to validate now.
Separate permissions for each action (upload, rename and delete) can be useful. But even the most basic Editable boolean setting that enable or disable all actions at once would be just enough.