fix(graph): keep CreateUploadSession strict below the public drive

The relaxed item addressing is a read feature; writing through it is untested
and not part of this surface.

services/graph/pkg/service/v0/driveitems.go

@@ -162,7 +162,9 @@ func (g Graph) CreateUploadSession(w http.ResponseWriter, r *http.Request) {
 		errorcode.RenderError(w, r, err)
 		return
 	}
-	if !driveItemInDrive(&driveID, &driveItemID) {
+	// strict on purpose: uploading through the public drive addressing is not
+	// part of the listing surface and stays untested for now
+	if driveID.GetStorageId() != driveItemID.GetStorageId() || driveID.GetSpaceId() != driveItemID.GetSpaceId() {
 		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "Item does not exist")
 		return
 	}