Here is the working solution using the standard HttpClient. 
Notice, there is a /file endpoint, not /upload one.

            using HttpClient client = new();
            client.DefaultRequestHeaders.Authorization = new BasicAuthenticationHeaderValue(_settings.CurrentValue.ServiceNowUsername, _settings.CurrentValue.ServiceNowPassword);

            var url = _settings.CurrentValue.ServiceNowUrl + "/api/now/attachment/file";

            url += "?table_name=" + HttpUtility.UrlEncode(tableName);
            url += "&table_sys_id=" + HttpUtility.UrlEncode(sysId);
            url += "&file_name=" + HttpUtility.UrlEncode(fileName);

            HttpRequestMessage request = new (HttpMethod.Post, url);
            request.Content = new StreamContent(stream);
            request.Content.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue("binary/octet-stream");

            return await client.SendAsync(request);