V2 Encryption followups (#7963)

* Add the account recovery V2 upgrade routes

GET /organizations/{orgId}/users/keys/pending-v2-upgrades lists, a page at a
time, the memberships whose account recovery key still wraps the member's V1
user key after an upgrade to V2 encryption, with the upgrade token the admin
re-wraps it from. POST .../v2-upgrades stores the re-wrapped keys in one
transaction, or unenrolls the members whose token holds no usable key. Only
Owners and Admins, an Admin never for Owners, and a membership that changed
since the read is skipped. GET /organizations/{orgId}/private-key gives the
organization's private key these need, to everyone with Manage users as
upstream. The SDK's encrypted migrator calls all three.

Enrolling in or withdrawing from account recovery drops a leftover upgrade
token, which would otherwise get a member who re-enrolled after the upgrade
unenrolled.

* Check membership for the organization public key in the handler

The public key routes serve the placeholder SSO organization's key to users
without an organization, so they couldn't require the member guard, but it
still ran for every request: it logged a membership error for each legitimate
v2 JIT password setup and authenticated the request twice. The routes now
authenticate once, return the placeholder key first, and check the membership
themselves, with the same rule as the guard.

* List attachments in sync with a stable URL

Sync and the cipher responses list each attachment with an unsigned URL of
upstream's form, which no longer changes on every sync nor costs a presign per
attachment on S3, and which isn't served without a token. The attachment routes
sign it: the cipher route and its admin variant, and the emergency access view's
route the web vault downloads through, which is added. The admin variant also
signs it for a member who can open the item themselves, because the web vault's
fallback to the listed URL no longer works.

* Seed the SDK live tests' vectors with their attachments

Sync now lists attachments with a stable URL, so the rotation test's before and after comparison holds with them.
Only the legacy attachments without a key of their own stay out: the SDK refuses to rotate a vault holding one.

src/db/models/attachment.rs

@@ -65,16 +65,33 @@ impl Attachment {
         }
     }
 
-    pub async fn to_json(&self, host: &str) -> Result<Value, crate::Error> {
-        Ok(json!({
+    /// The attachment as sync and the cipher responses list it. Its `url` is a leftover from the old download flow.
+    /// Clients get a signed URL from the attachment routes (`to_json_for_download`) instead, only the web vault and the
+    /// CLI read this one, as a fallback when those routes answer 404.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/341acc9d3d8988cec8fe05debfa6d557cf5ab749/src/Api/Vault/Models/Response/AttachmentResponseModel.cs#L24-L29>
+    pub fn to_json(&self, host: &str) -> Value {
+        self.json_with_url(&format!("{host}/attachments/{}/{}", self.cipher_uuid, self.id))
+    }
+
+    /// The attachment with a `url` the client can download it from for a short while, for the attachment routes
+    /// (`GET /ciphers/{id}/attachment/{attachmentId}`, its admin variant, the emergency access one).
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/341acc9d3d8988cec8fe05debfa6d557cf5ab749/src/Api/Vault/Controllers/CiphersController.cs#L1699-L1717>
+    pub async fn to_json_for_download(&self, host: &str) -> Result<Value, crate::Error> {
+        Ok(self.json_with_url(&self.get_url(host).await?))
+    }
+
+    fn json_with_url(&self, url: &str) -> Value {
+        json!({
             "id": self.id,
-            "url": self.get_url(host).await?,
+            "url": url,
             "fileName": self.file_name,
             "size": self.file_size.to_string(),
             "sizeName": crate::util::get_display_size(self.file_size),
             "key": self.akey,
             "object": "attachment"
-        }))
+        })
     }
 }