feat(storage-s3): presigned URLs for file downloads

[r1tsuu]

Adds pre-signed URLs support file downloads with the S3 adapter. Can be enabled per-collection:

s3Storage({
  collections: {
    media: { signedDownloads: true }, // or { signedDownloads: { expiresIn: 3600 }} for custom expiresIn (default 7200)
  },
  bucket: process.env.S3_BUCKET,
  config: {
    credentials: {
      accessKeyId: process.env.S3_ACCESS_KEY_ID,
      secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    },
    endpoint: process.env.S3_ENDPOINT,
    forcePathStyle: process.env.S3_FORCE_PATH_STYLE === 'true',
    region: process.env.S3_REGION,
  },
}),

The main use case is when you care about the Payload access control (so you don't want to use disablePayloadAccessControl: true but you don't want your files to be served through Payload (which can affect performance with large videos for example).
This feature instead generates a signed URL (after verifying the access control) and redirects you directly to the S3 provider.

This is an addition to #11382 which added pre-signed URLs for file uploads.

[Copilot]

Pull Request Overview

This PR introduces pre-signed URL support for file downloads via the S3 adapter with a new per-collection configuration option. Key changes include adding a signedDownloads config option to the S3 storage adapter, incorporating AWS SDK’s GetObjectCommand with getSignedUrl in staticHandler.ts, and updating index.ts to pass the signedDownloads configuration.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/storage-s3/src/staticHandler.ts	Adds the signed URL generation block and associated logic for downloads
packages/storage-s3/src/index.ts	Updates collection configuration and wiring of signedDownloads value

[DanRibbens]

Small feedback, looks like the right approach to me!

We probably also should have an int test.

[DanRibbens]

This will need to be cached once we have a strategy for caching or possibly the KV storage.