Fix mismatched package upload creating a new title instead of erroring

[cdcme]

Related issue: Resolves #49209

Adding a package to an existing software title (POST /software/package with software_title_id) now validates that the uploaded installer actually belongs to that title. Previously the software_title_id sent by the title page's "Add package" flow was ignored, so uploading mismatched software (e.g. a 1Password package onto a Zoom title) silently created a new separate title instead of erroring. It now returns a 400 with a clear message and writes nothing. When software_title_id is omitted (general "Add software" flow, GitOps), behavior is unchanged.

Checklist for submitter

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.10%. Comparing base (06863c4) to head (ec6e5b2).

Additional details and impacted files

@@                           Coverage Diff                           @@
##           feat/28108-multiple-custom-packages   #49264      +/-   ##
=======================================================================
+ Coverage                                65.72%   68.10%   +2.38%     
=======================================================================
  Files                                     3768     3768              
  Lines                                   239399   239409      +10     
  Branches                                 12555    12555              
=======================================================================
+ Hits                                    157345   163055    +5710     
+ Misses                                   67232    61661    -5571     
+ Partials                                 14822    14693     -129     

Flag	Coverage Δ
backend	69.60% <100.00%> (+2.83%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jkatz01]

Did this endpoint not have a title_id field before? Does this need a followup frontend PR?

[cdcme]

Right, it didn't. The frontend already sends software_title_id (from the Add package modal), but the backend was silently dropping it. DecodeRequest never read it and the payload had nowhere to put it, so uploads always match-or-created a title from the installer itself. That's what caused this particular bug (1Password onto Zoom just made a new 1Password title).

No frontend follow-up needed! The client already sends the field, this just makes the server honor and validate it. The modal already shows the server error; I confirmed in QA that the mismatch now surfaces the 400 instead of silently creating a title.