Removed Provider.UploadURL

[Alexamakans]

• I've added a new note in the CHANGELOG.md file, according to docs:
  https://iver-wharf.github.io/#/development/changelogs/writing-changelogs

Summary

Removed field Provider.UploadURL and all references to it.
Added migration to remove DB column provider.upload_url

Motivation

This field was unused and mostly lead to confusion.

Notes

Tried building wharf-web after the change but it wouldn't pass because MainProvider.uploadUrl from the previous swag definitions was used at src/app/providers/providers.service.ts:L50.

The change of id -> Id from #76 also causes the build to fail because of the auto-generated names for the endpoint functions, so I believe a MAJOR version bump is in order.

--
Closes #56.

[Alexamakans]

Both security alerts are valid I think, related to iver-wharf/wharf-provider-azuredevops#19, but for database queries.

They are validated to be fully qualified URLs in the provider repos, but since this validation happens outside of the wharf-api repo there is nothing stopping anybody from crafting their own request.

[applejag]

Both security alerts are valid I think, related to iver-wharf/wharf-provider-azuredevops#19, but for database queries.

They are validated to be fully qualified URLs in the provider repos, but since this validation happens outside of the wharf-api repo there is nothing stopping anybody from crafting their own request.

The security alerts are about SQL injections. GORM does not have any known SQL injection issues, as it escapes all values for us. From the "Recommendation" section of the alert:

/.../ Use these features rather than building queries by string concatenation.

https://github.com/iver-wharf/wharf-api/security/code-scanning/33?query=ref%3Arefs%2Fpull%2F82%2Fmerge+ref%3Arefs%2Fpull%2F82%2Fhead+ref%3Arefs%2Fheads%2Ffeature%2Fremove-provider-upload-url

We're not concatenating any strings... Those with Rule ID go/sql-injection are false-positives