Issue #3596253: serve pdv_file upload-mode files the standard webform way

The pdv_file element has two storage modes: a vault reference (link mode), and an uploaded local copy (the default, including vault picks materialized to a local file). Both were served through the custom pdv_webform.download controller, which streamed the bytes and gated them by the submission-view permission.

For the upload mode that is unnecessary. The file is an ordinary managed file in private://pdv-uploads carrying webform / webform_submission file usage, so webform's standard private-file path already gates it: system.files route -> hook_file_download -> WebformManagedFileBase::accessFile(), which checks view access to the owning submission. It was not used only because PdvFile is a composite and never advertised file-download access, so its files were unservable by the standard route and the custom controller streamed them instead.

Change

• PdvFile implements WebformElementFileDownloadAccessInterface, scoped to its own private://pdv-uploads directory, delegating to WebformManagedFileBase::accessFileDownload(). Upload-mode files are now gated and served exactly like any other webform submission upload.
• formatHtmlItem() links upload-mode values to the standard managed-file download URL; only vault references keep the pdv_webform.download route (decrypted per viewer, no local file).
• The controller and PdvFileValue::resolveFile() are now vault-only; the dead resolveBytes() and the unreachable upload branch are removed; the private://pdv-uploads literal is consolidated into PdvFile::UPLOAD_DIRECTORY.

Tests: upload-mode links to the standard file URL, the controller 404s an upload-source value, accessFileDownload defers for foreign URIs. Full pdv_webform suite green; phpcs and phpstan clean.