Fix: Scope changelog DB lookup to caller's authorized parent record

[PujaDeshmukh17]

Describe your changes

The changelog action was vulnerable to IDOR (CWE-639, CWE-284). A caller could supply an arbitrary attachment ID in the OData navigation path and retrieve the changelog for any SDM document in the repository, regardless of whether the source document belonged to a parent record they were authorized to access.

Neither the Named user flow (repository-level role check only) nor the Technical user flow (service account, full access) provided record-level protection in SDM. The only authorization gate needed to be at the CAP/DB layer, and it was missing.

The changelog handler now verifies that the requested attachment belongs to the caller's own parent record before fetching its history from SDM. Previously, any authenticated user could retrieve the changelog of any document in the repository by supplying an arbitrary attachment ID. The fix scopes the database lookup to the caller's authorized record, so an unauthorized ID is rejected before the SDM call is ever made. Existing behavior is preserved where the parent record cannot be determined. A failing unit test was updated to reflect the new error type thrown by the handler.

Any documentation

• Single tenant integration test: https://github.com/cap-java/sdm/actions/runs/38521641514
• Multi tenant integration test: https://github.com/cap-java/sdm/actions/runs/38527024984

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist before requesting a review

• I follow Java Development Guidelines for SAP
• I have tested the functionality on my cloud environment.
• I have provided sufficient automated/ unit tests for the code.
• I have increased or maintained the test coverage.
• I have ran integration tests on my cloud environment.
• I have validated blackduck portal for any vulnerability after my commit.

Upload Screenshots/lists of the scenarios tested

• I have Uploaded Screenshots or added lists of the scenarios tested in description