Secure repository file paths and stream downloads

[aaronzi]

Summary

This PR fixes unsafe repository file handling for thumbnails, submodel attachments, and AASX packages.

Uploaded filenames are no longer used as repository ids or filesystem paths. They are treated as logical display names only, validated centrally, and stored as metadata while repository storage uses generated ids.

Changes

• Added shared file lifecycle helpers in FileRepositoryHelper

  • validates uploaded logical filenames
  • rejects traversal/path-like names
  • stores files under generated ids
  • preserves original filenames as metadata
  • centralizes save/update/delete behavior
  • provides safe stream and temp-file retrieval paths

• Updated AAS thumbnail handling

  • stream downloads via repository InputStream
  • safe temp-file fallback for legacy File API
  • delete old thumbnail content after successful replacement
  • handle missing/cleared thumbnails as FileDoesNotExistException

• Updated submodel attachment handling

  • stream HTTP downloads by idShortPath
  • avoid materializing previous files just to compare values
  • authorize streamed downloads by submodel element path, not repository id

• Updated AASX package handling

  • use the same shared helper as thumbnails and attachments
  • reject traversal filenames on create/update
  • update package metadata before deleting old repository content

• Preserved Java API compatibility

  • new stream methods are default methods on public interfaces
  • server implementations override them with direct streaming behavior

Tests

• Added regression tests for malicious filenames and safe repository ids
• Added thumbnail and submodel streaming/path traversal coverage
• Added authorization coverage for attachment stream access
• Added AASX create/update filename validation coverage

[FriedJannik]

i approve