[gnacho]

Problem

A calendar object resource could hold more than one distinct UID, and a body with
more than one vCard was stored as a single item. Two unrelated events under one
href share a single ETag, so a client cannot move, edit or delete them one by
one, and the sync semantics of DAVx5 and the iOS/macOS calendars break. A
component without UID is the same defect: it is stored but unreachable.

Evidence

internal/dav/objects.go (validateItem) kept the last UID seen while
walking the components, and the vCard path decoded only the first card of the
body, so:

• VCALENDAR with UID:e1 and UID:e2, PUT as e2.ics, returned 201 and
  stored both events.
• a VCALENDAR with a second VEVENT without UID was stored too.
• a body with two VCARDs, first one named like the resource, returned 201.

Changes

• validateItem now requires every VEVENT/VTODO/VJOURNAL to carry a UID
  and all of them to be the same one, which keeps the legitimate shape working:
  a master event plus overrides that share its UID and carry RECURRENCE-ID
  (RFC 4791).
• The vCard path decodes a second card and refuses it: one vCard per resource,
  same reasoning.
• Refusals happen before the write, so a rejected PUT leaves nothing on disk.

Verification

• Regression tests added, checked red against the unfixed code and green
  after the fix: TestPutRejectsMultipleUIDs (two UIDs, and a component without
  UID), TestPutAcceptsRecurringEventWithOverride, TestPutRejectsMultipleVCards.
• go test ./... -race -shuffle=on, go vet ./..., gofmt -l . and
  go mod tidy clean; govulncheck ./... reports no vulnerabilities.

Closes #40