Something like this seems to work, it is based on visitors registering and uploading a Tax Exemption Certification, stored in the x_tax_exemption field:

Code:

for record in records:
  attachment = env['ir.attachment'].create(  \
      {'name': 'Tax Exemption',
       'type': 'binary',
       'datas': record.x_tax_exemption,
       'res_model': 'crm.lead',
       'res_id': record.id,})