feat(12-01): record multipart uploads and match Winter upload URLs

- attach.PublicURL and (*File).URL build Winter File::getPath() URLs; the
  thumbnailer decodes webp via golang.org/x/image v0.46.0 and checks the
  image size from the header before decoding
- tide requests carry multipart parts (files beside the fixture pinned by
  sha256) encoded with the fixed MultipartBoundary, so PHP and Go receive
  byte-identical bodies
- tide masks the random partition, disk name and file id of url/thumb_url
  upload URLs while still diffing prefix, size, mode and extension, and
  NormalizePublications masks Carbon dates in the published album

modules/tide/diff.go

@@ -13,11 +13,15 @@ import (
 )
 
 func compareBodies(want, got Response, step Step) []Diff {
+	return compareBodiesWith(want, got, step, maskOptions{})
+}
+
+func compareBodiesWith(want, got Response, step Step, opts maskOptions) []Diff {
 	wantJSON := isJSONContentType(want.Headers)
 	gotJSON := isJSONContentType(got.Headers)
 	if wantJSON && gotJSON {
-		wantRaw, wantDiffs := normalizeJSON([]byte(want.Body), step)
-		gotRaw, gotDiffs := normalizeJSON([]byte(got.Body), step)
+		wantRaw, wantDiffs := normalizeJSON([]byte(want.Body), step, opts)
+		gotRaw, gotDiffs := normalizeJSON([]byte(got.Body), step, opts)
 		diffs := append([]Diff{}, wantDiffs...)
 		diffs = append(diffs, gotDiffs...)
 		diffs = append(diffs, diffJSON(wantRaw, gotRaw)...)