fix(attachments): prevent orphaned DMS files by moving DMS operations to on phase (opt-in)

[akgarg06]

Describe your changes

Problem

DMS operations (upload, rename, delete, link-revert) ran in CAP before handlers.
Since before-handlers execute concurrently and the error gate is checked only after
they all complete, a validation reject (or any rollback) could abort the CAP
transaction after the DMS call already executed — leaving an orphaned file in DMS
with no DB record. srv.prepend does not fix this (ordering ≠ prevention).

Fix

Move all DMS-mutating attachment handlers from before to the on phase
(prepended, with next() chaining). CAP only enters on if no before errors
occurred, so a validation reject now prevents the DMS operation entirely.

Handlers moved: draft upload, non-draft create/upload, non-draft update/rename,
draft rename (SAVE), non-draft rename, draft discard, draft-attachment delete.
Prep/collect/read handlers stay in before; the DMS delete stays in after.

Opt-in flag (default OFF — no behavior change unless enabled)

• cds.requires.sdm.settings.uploadInOnPhase: true, or
• env var SDM_UPLOAD_IN_ON_PHASE=true

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

Checklist before requesting a review

• I have tested the functionality on my cloud environment.
• I have provided sufficient automated/ unit tests for the code.
• I have increased or maintained the test coverage.
• I have ran integration tests on my cloud environment.
• I have validated blackduck portal for any vulnerability after my commit.

Upload Screenshots/lists of the scenarios tested

• I have Uploaded Screenshots or added lists of the scenarios tested in description

Multi tenant Integration test : https://github.com/cap-js/sdm/actions/runs/31776642709
Single Tenant Integration test : https://github.com/cap-js/sdm/actions/runs/31776340192