Implement idempotency into the final concat request

[ollie-sutton]

Summary

• Fix non-idempotent concatenation that creates duplicate uploads when requests are interrupted (e.g. by WAF timeouts)
• Derive a deterministic upload ID from partial upload IDs using SHA-256, so retried concat requests target the same final upload
• Before creating a new final upload, check if one already exists: return it if complete, retry concat if incomplete, or error if in a corrupted partial state

Issue

See #1364