[Security] Missing throwIfSecurityUser check in AttachmentController createAttachment

[sneha4175]

Description

The createAttachment POST endpoint in AttachmentController is missing
restControllerHelper.throwIfSecurityUser(sw360User) check.

This check is consistently present in:

• Both GET endpoints of the same AttachmentController
• All write methods in ReleaseController (10 occurrences)

Location

File: rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/attachment/AttachmentController.java
Method: createAttachment() (~line 145)

Current Code

final User sw360User = restControllerHelper.getSw360UserFromAuthentication();
List<EntityModel<Attachment>> attachments = new ArrayList<>();

Expected Code

final User sw360User = restControllerHelper.getSw360UserFromAuthentication();
restControllerHelper.throwIfSecurityUser(sw360User);
List<EntityModel<Attachment>> attachments = new ArrayList<>();

Impact

Security users (restricted API token users) can upload attachments
bypassing the intended access restriction enforced on all other endpoints.