Publish author posts only with editor approval?

Add the following code to your functions.php:

function allow_contributor_uploads() {
    $contributor = get_role('contributor');
    $contributor->add_cap('upload_files');
}
if ( current_user_can('contributor') && !current_user_can('upload_files') ) {
    add_action('admin_init', 'allow_contributor_uploads');
}

This will add the upload_files capability to the Contributor role. It only needs to run once; just login to admin as a user with the Contributor role. After it successfully adds the capability, you can remove (or comment out) the code if you want.

To remove the upload_files capability and return the Contributor role to default, use the following:

function deny_contributor_uploads() {
    $contributor = get_role('contributor');
    $contributor->remove_cap('upload_files');
}
if ( current_user_can('contributor') && current_user_can('upload_files') ) {
    add_action('admin_init', 'deny_contributor_uploads');
}

Plugin Option

From the suggestions made by Kaiser, here is a plugin that will create a NEW user role with the Contributor capabilities (edit, delete and read posts), PLUS the upload files capability.

<?php
/**
 * Plugin Name: Add Contributor Plus Role
 * Description: Activate plugin to create a user role with Contributor capabilities, PLUS upload_files.
 * Plugin URI: http://wordpress.stackexchange.com/questions/165951/publish-author-posts-only-with-editor-approval/165957#165957
 * Version: 1.0
 */

add_action( 'wp_loaded', 'add_new_contributor_plus_role');
function add_new_contributor_plus_role() {
    add_role(
        'contributor_plus',
        __( 'Contributor Plus' ),
        array(
            'edit_posts'   => true,
            'delete_posts' => true,
            'read'         => true,
            'upload_files' => true
        )
    );
}
?> 

Add the above code to /wp-content/plugins/add-contributor-plus-role/add-contributor-plus-role.php, OR create the /add-contributor-plus-role/add-contributor-plus-role.php folder and file locally, add to a zip file, and upload using Plugins > Add New > Uploads. Feel free to change the name of the user role to whatever you want.

Active the plugin and the role will be added. You can deactivate the plugin, and delete it; it won’t effect the newly created user role.

If you change your mind and want the “Contributor Plus” user role removed, use the following in place of the add_role lines (through to the ; semicolon) and active the plugin once more:

remove_role( 'contributor_plus' );