5.2 - File uploads over multipart/form-data

JSON-RPC methods can now receive file uploads over multipart/form-data, alongside their structured parameters, in a single call. Opt-in and off by default; with the feature off, behaviour is identical to 5.1.

Contributed by @tacman (#9), in the shape agreed in #8. Thank you.

How it works

• Turn it on in two places: multipart.enabled: true for the application, and acceptsMultipart: true on the method's #[JsonRPCAPI] attribute. A multipart call to a method without the flag is -32600.
• The request carries a jsonrpc form field with the full JSON-RPC request object (scalar params included), plus one part per file, the part name being the parameter name. Declare the parameter as Symfony\Component\HttpFoundation\File\UploadedFile and hydration does the rest.
• File validation is Symfony's own: a declared UploadedFile compiles to Assert\Type followed by Assert\File, so multipart.max_file_bytes (Symfony size notation, e.g. '10Mi') and every PHP upload error come back as -32602 naming the field.
• The call logger records a file as {originalName, size, mimeType} metadata, never its content. The OpenAPI generator publishes a multipart/form-data request body for flagged methods.

Security

multipart/form-data is a CORS "simple request", so enabling it reopens - for the flagged methods only - the CSRF vector the mandatory Content-Type: application/json closed in 5.0. If your app authenticates with cookies, read the "before you switch it on" section of the docs first.

Limits

Batch stays JSON-only, files at the top level of params only, POST only.

Full docs: docs/multipart.md. Changelog: CHANGELOG.md.

Backwards compatibility: none required. With multipart.enabled: false (the default), nothing changes.