Backfill auth bypass ids onto existing draft edition assets

The preceding commits fix auth bypass id propagation going forward for
call for evidence response forms and cropped images, but existing
pre-publication editions already carry an auth_bypass_id whose value was
never written to some of their assets in Asset Manager - cropped image
assets, and call for evidence response form (and outcome attachment)
assets. As a result the preview link for those drafts does not grant
access to the affected assets.

This data migration propagates each pre-publication edition's existing
auth_bypass_id to its image assets, and - for call for evidence - its
response form and outcome attachment assets, bringing them into a
consistent state before the rest of the preview token work is built on
top.

It enqueues AssetManagerUpdateAssetJob directly rather than reusing
EditionAuthBypassUpdater, because that service regenerates the token
(set_auth_bypass_id). Minting a new id would invalidate any preview link
publishers have already shared, which is the opposite of what the
backfill needs - we want to preserve the existing id and only repair the
assets.

Author: TonyGDS

db/data_migration/20260612120000_backfill_auth_bypass_ids_on_draft_edition_assets.rb

@@ -0,0 +1,48 @@
+editions = Edition
+  .where(state: Edition::PRE_PUBLICATION_STATES)
+  .where.not(auth_bypass_id: nil)
+
+asset_count = 0
+
+editions.find_each do |edition|
+  new_attributes = { "auth_bypass_ids" => [edition.auth_bypass_id] }
+
+  if edition.respond_to?(:images)
+    edition.images.each do |image|
+      AssetManagerUpdateAssetJob.perform_async_in_queue(
+        "asset_manager_updater",
+        "ImageData",
+        image.image_data.id,
+        new_attributes,
+      )
+      asset_count += 1
+    end
+  end
+
+  next unless edition.is_a?(CallForEvidence)
+
+  response_form = edition.call_for_evidence_participation&.call_for_evidence_response_form
+  if response_form&.call_for_evidence_response_form_data.present?
+    AssetManagerUpdateAssetJob.perform_async_in_queue(
+      "asset_manager_updater",
+      "CallForEvidenceResponseFormData",
+      response_form.call_for_evidence_response_form_data.id,
+      new_attributes,
+    )
+    asset_count += 1
+  end
+
+  next if edition.outcome.blank?
+
+  edition.outcome.attachments.files.each do |file_attachment|
+    AssetManagerUpdateAssetJob.perform_async_in_queue(
+      "asset_manager_updater",
+      "AttachmentData",
+      file_attachment.attachment_data.id,
+      new_attributes,
+    )
+    asset_count += 1
+  end
+end
+
+puts "Enqueued auth bypass propagation for #{asset_count} draft edition assets"