Enforce maximum attachment size on repository UI file uploads

What does this MR do and why?

This MR enforces the "Maximum attachment size" admin setting on files uploaded to a repository through the GitLab UI "Upload file" button. Previously the setting applied only to comment and reply attachments, so a repository upload of any size was accepted.

The original reporter was able to commit a 417 MiB file with the instance limit set to 50 MiB. This was reproduced on a local GDK instance on 2026-09-15.

Why this gap existed:

• Workhorse: this upload path falls through to Workhorse's catch-all route, which pre-authorizes against the generic /api/v4/internal/workhorse/authorize_upload endpoint. That endpoint returns only a TempPath and no MaximumSize, so Workhorse streams the file with no size limit.
• Rails: Projects::BlobController#create and #update never consulted Gitlab::CurrentSettings.max_attachment_size.
• Git hooks: Gitlab::Checks::FileSizeLimitCheck is a no-op in CE. The real implementation is EE-only and draws its limit from an EE push rule or a SaaS-only plan limit, which is why this does not reproduce on GitLab.com.
• Maximum push size: this setting does not apply either, because a UI upload is a Gitaly UserCommitFiles RPC rather than a git push, so receive.maxInputSize is never injected.

References

#510326 (closed)

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. In Admin Area, go to Settings > General > Account and limit and set "Maximum attachment size (MiB)" to 50.
2. Create a file larger than 50 MiB: head -c 55574528 /dev/urandom > large.bin
3. In a project, select the "Upload file" button and choose that file.
4. The modal shows File is too big (53.00MiB). Max filesize: 50MiB. and the commit button stays disabled. No commit is created.
5. Confirm the server-side check independently by disabling JavaScript or by posting the file directly to the create-blob endpoint; the response is HTTP 413 and no commit is created.
6. Set the limit back to 100, then confirm a file under the limit still uploads and commits normally.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.