Add original checksums for TUS uploads

[zerox80]

Summary

Adds client-computed SHA1 checksums for TUS uploads so OpenCloud receives the checksum of the original upload source instead of a late checksum over whatever file is about to be uploaded.

This PR also includes the content-URI cache validation from #184 because that PR is not merged yet. Without that validation, a stale partial cache file could still be reused before the checksum path has a trustworthy original source.

Changes

• Compute SHA1 from the original local file or original content:// stream before creating a TUS upload.
• Persist the checksum in the existing tusUploadChecksum column as sha1:<hex> so retries and recreated sessions use the same source checksum.
• Send the checksum in TUS Upload-Metadata as checksum = SHA1 <hex>.
• Disable creation-with-upload for checked uploads so all bytes are sent through PATCH chunks.
• Send Upload-Checksum: sha1 <base64(raw chunk sha1)> on each TUS PATCH.
• Treat checksum rejection (400 / 460) as a retryable TUS failure instead of falling back to unchecked PUT.
• Validate content-URI cache files against the original transfer size and copy through .part files before upload.

Validation

• git diff --check passed.
• git diff --cached --check passed before commit.
• ./gradlew.bat :opencloudApp:testOriginalDebugUnitTest could not run locally: JAVA_HOME is not set and no java executable is available in PATH.
• ./gradlew.bat :opencloudComLibrary:testDebugUnitTest could not run locally for the same Java environment reason.
• ./gradlew.bat :opencloudApp:compileOriginalDebugKotlin could not run locally for the same Java environment reason.

Fixes #181 when combined with the included partial-cache validation.
Depends on / supersedes #184 if this PR is merged first.