Change the privacy level of files on AWS S3

## Current Scenario

Currently, anyone can access the files using the S3 links. This creates a potential threat of getting the test annotations being exposed to the public if someone gets the URL. We want to protect the files to be only accessible from the particular hostnames by setting the policy in S3 and modify the Django views to give permission to the particular set of users.

## Deliverables

- [ ] Add policy on S3 to restrict the access from particular hostnames (see this https://blog.botreetechnologies.com/aws-s3-file-upload-access-control-using-boto3-with-django-web-framework-11114de2d928 for more details)
- [ ] Update the Django view using which any file served as a media has to pass through a decorator which will check whether to give access of this file to the user or not (see this https://stackoverflow.com/questions/28364935/amazon-s3-and-django-allow-only-the-users-from-my-website-and-not-the-anonymou?answertab=active#tab-top to know how to implement this)

Start by locating the Django views that serve media files and the project’s AWS S3 configuration, then review the two linked implementation references. Done means S3 access is restricted to the intended hostnames and media-serving views authorize the requesting user through a decorator.

Written by the indexing model from the issue text.