previously attr handling was a right mess with at least one leak I think.
attrs must be freed but doing so manually all over the place complicates
things considerably. since all attributes were ultimately scoped to the
functions they were used in anyway it's much cleaner to use a
qscopedpointer with custom deleter instead.

this also enables us to stop GetRequest taking ownership (implicitly)
of the sftp ptrs passed in. and that in turn was a huge blocker for
letting ::read() use GetRequest