Address review: keep disk PUT CSRF-exempt, use intent helpers

- Including Authentication re-arms protect_from_forgery on DiskController.
  Active Storage's direct-upload service PUT (#update) sends only signed
  service headers and no CSRF token, so a real authenticated upload would
  422 storing bytes. Re-exempt #update from forgery protection; the signed
  URL token and session check still gate the write.
- Swap the raw skip_before_action for the Authentication concern's
  intent-revealing allow_unauthenticated_access / allow_bot_access helpers
  on #show, matching the rest of the app.
- Scope the test's ActiveStorage::Current.url_options override to a
  set { } block so it can't leak thread-local state into later tests.

test/controllers/active_storage/direct_uploads_controller_test.rb

@@ -26,9 +26,10 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
   test "disk show stays reachable without authentication" do
     blob = ActiveStorage::Blob.create_and_upload! \
       io: StringIO.new("hello"), filename: "hello.txt", content_type: "text/plain"
-    ActiveStorage::Current.url_options = { host: "once.campfire.test", protocol: "http" }
 
-    get blob.url
+    ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
+      get blob.url
+    end
 
     assert_response :success
   end