Arbitrary S3 object writes via signed URL issuance

Missing authorization in the attachment URL API in Budibase before 3.41.3 allows remote authenticated users to write S3 objects via signed URLs. POST /api/attachments/:datasourceId/url accepts caller-controlled bucket and key values and returns signedUrl and publicUrl values generated with the datasource's stored S3 credentials instead of enforcing a permission check on that datasource or write target. Reachability requires a published-app account with the BASIC role and knowledge of a valid datasourceId, after which the caller can upload attacker-chosen content wherever the configured credentials permit and potentially overwrite existing objects.