Download the binary content of a OneDrive/SharePoint file via Microsoft Graph, handling the 302 redirect and the pre-authenticated @microsoft.graph.downloadUrl.

Documented steps

1. Call GET /me/drive/items/{item-id}/content (equivalently /drives/{drive-id}/items/{item-id}/content, /me/drive/root:/{item-path}:/content, /sites/{siteId}/drive/items/{item-id}/content, or /shares/{shareIdOrEncodedSharingUrl}/driveItem/content) with Authorization: Bearer {token}.
2. The API returns HTTP 302 Found with a Location header pointing to a preauthenticated download URL — the same URL exposed via the @microsoft.graph.downloadUrl property on the driveItem. Most HTTP client libraries follow the 302 automatically.
3. No Authorization header is needed when fetching the Location/downloadUrl target — it is preauthenticated. These URLs are valid only for a limited time and might expire within minutes, so use them immediately rather than caching.
4. For browser/JS apps: do not call /content directly — a 302 redirect is prohibited when a CORS preflight is required (an Authorization header forces preflight). Instead GET /drive/items/{item-ID}?select=id,@microsoft.graph.downloadUrl, then fetch that URL directly (no preflight needed).
5. For partial/range downloads, send a Range header (e.g. Range: bytes=0-1023) to the @microsoft.graph.downloadUrl target, not to /content. A successful partial request returns HTTP 206 with Content-Range; if the server can't satisfy the range it may ignore the header and return a full 200.
6. Including if-none-match (with an etag/cTag) on the /content GET returns HTTP 304 Not Modified if the tag still matches, letting you skip re-downloading unchanged content.
7. Docs: https://learn.microsoft.com/en-us/graph/api/driveitem-get-content?view=graph-rest-1.0