MDL-86802 core: make CURLOPT_USERPWD optional for put()

Microsoft does not always allow an Authorization header when using PUT but the put() method sets one
by default - https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession?view=graph-rest-1.0#remarks.
I've included an optional argument to prevent this, but the default
value will maintain the pre-existing logic to avoid other regressions.

public/lib/filelib.php

@@ -4135,9 +4135,10 @@ class curl {
      * @param string $url
      * @param array $params
      * @param array $options
+     * @param bool $includeuserpwd Whether to include CURLOPT_USERPWD if not already set
      * @return ?string
      */
-    public function put($url, $params = array(), $options = array()) {
+    public function put($url, $params = [], $options = [], $includeuserpwd = true) {
         $file = '';
         $fp = false;
         if (isset($params['file'])) {
@@ -4151,7 +4152,7 @@ class curl {
             } else {
                 return null;
             }
-            if (!isset($this->options['CURLOPT_USERPWD'])) {
+            if (!isset($this->options['CURLOPT_USERPWD']) && $includeuserpwd) {
                 $this->setopt(array('CURLOPT_USERPWD' => 'anonymous: [email protected]'));
             }
         } else {

public/repository/onedrive/lib.php

@@ -792,7 +792,7 @@ class repository_onedrive extends repository {
     protected function upload_file(\repository_onedrive\rest $service, \curl $curl, \curl $authcurl,
                                    $filepath, $mimetype, $parentid, $filename) {
         // Start an upload session.
-        // Docs https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/item_createuploadsession link.
+        // Docs https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession?view=graph-rest-1.0 link.
 
         $params = ['parentid' => $parentid, 'filename' => urlencode($filename)];
         $behaviour = [ 'item' => [ "@microsoft.graph.conflictBehavior" => "rename" ] ];
@@ -813,7 +813,8 @@ class repository_onedrive extends repository {
             $curlinstance->setHeader('Content-type: ' . $mimetype);
             $size = filesize($filepath);
             $curlinstance->setHeader('Content-Range: bytes 0-' . ($size - 1) . '/' . $size);
-            $response = $curlinstance->put($created->uploadUrl, $options);
+            // Microsoft does not allow authorization headers for PUT, so we do not include them here.
+            $response = $curlinstance->put($created->uploadUrl, $options, [], false); // False = do not include auth header.
             if ($curlinstance->errno == 0) {
                 $response = json_decode($response);
             }