Allow a process instance to be attached to multiple content entities (keyed attachments)

Problem. orchestra_content binds a process instance to one content entity via the orchestra_attachment side entity. The resolution API (AttachmentManager::attachmentFor() / entityFor()) returns a single attachment and nothing can address more than one, so a run can be "about" only one entity. A workflow that legitimately concerns several entities (for example an order plus its customer and its invoice) cannot bind them all as first-class, reverse-lookupable, task-targetable subjects. The storage even allows several rows per instance today (no unique constraint, attach() does not dedupe), but attachmentFor() resolves one arbitrarily, so extra attachments are storable yet unusable.

Proposed solution. Make attachments keyed, so an instance can bind several entities under distinct keys (roles), each addressable, while the default (empty) key behaves as today's single subject.

• Add a "key" field to orchestra_attachment (default empty = the primary subject).
• One attachment per (instance, key): attach() with a key is update-or-create for that key; a different key coexists.
• API: attach($instance, $entity, $key), attachmentFor($instance, $key), entityFor($instance, $key), attachmentsFor($instance) and entitiesFor($instance) keyed by key, instancesFor($entity, $key).
• Consumers pick which: the "target: attached" action and the content-bound task types take an optional attachment key (default = primary).

Backwards compatibility. The default empty key is the current single subject, so existing workflows and the action keep working. Pre-1.0, the new field rides a fresh install (no update hook); the live site is patched by hand.