feat: support private S3 buckets

[mattkrick]

Description

Fix #9684

This adds support for partially private buckets.
This only applies if an instance uses S3 and has the env var IS_ENTERPRISE=true
It also removes AWS_S3_BUCKET since that info is derived from CDN_BASE_URL.
The S3 Client version must be pinned to exactly this version! Older versions have no support for bucketEndpoints. Any newer & there's a bug for presigned URLs: aws/aws-sdk-js-v3#6045.

How it works:

• fileStore URLs remain unchanged in the DB
• At the GraphQL layer, between the DB and the client, the URL is transformed into a presigned temporary URL
• The client receives this presigned URL & fetches it without any extra headers

Demo

Testing scenarios

• create an account, the avatar loads everywhere!
• run predeploy & assets get pushed to the file store
• change your org & user avatars & it works