Forward metadata param on signed uploads in Util.buildUploadParams

[sebastienmartin-bm]

🔍 Brief Summary of Changes

Hello there @const-cloudinary, it seems you are the person in charge taking care of the repository 💪
Here is a little PR that hopefully solves and explain an issue we encountered lately with @vschoener

When an upload request carries a server-computed signature, Util.buildUploadParams takes a "pre-signed" branch that forwards only a fixed allow-list of write params.

🐛 Our issue: metadata is not on the "allow-list" list, so it is silently dropped and never sent to Cloudinary that re-compute the signature against our backend:

401 Invalid Signature ... String to sign - 'asset_folder=...&timestamp=...&upload_preset=...'

(Note metadata is absent from the string Cloudinary reconstructs.)

Root cause

In cloudinary-core/.../com/cloudinary/Util.java, buildUploadParams only copies metadata via processWriteParameters, which is only called if there are no signatures.

The else (signature-present) branch forwards eager, transformation, headers, tags, face_coordinates, context, ocr, raw_convert, categorization, detection, similarity_search, auto_tagging, access_control - but not metadata.

Fix

Add metadata to the pre-signed pass-through branch, mirroring how context is already handled there (the value is already serialized, so it's passed through as-is).

📑 Note on SDK parity w/ 🍎

The iOS SDK does not filter params on the signed path (CLDNetworkCoordinator.getSignedRequestParams forwards the full param set), so a presigned upload including metadata already works on iOS.

This change brings the Java/Android SDK in line (at least for the metadata).

ℹ️ With this changes we were able to fix our upload issue by making cloudinary-android-core a local patched module of cloudinary-core.

Many thanks for your time reviewing the PR 🙏

What does this PR address?

• GitHub issue
• Refactoring
• New feature
• Bug fix
• Adds more tests

Are tests included?

• Yes
• No

✅ Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I ran the full test suite before pushing the changes and all the tests pass.

[adimiz1]

Thanks for the well-researched PR! The fix is correct, metadata is serialized by the caller on the pre-signed path, so passing it through mirrors the existing context handling and aligns with the iOS SDK behavior. Verified the new test passes locally.

One note for the changelog: users who currently pass metadata alongside a signature that doesn't cover it will go from a silent drop to a 401, so we'll flag this in the release notes.