Omnichannel end users can't download files unless we disable frame-src CSP or whilelist all of s3

Description:

If we're chatting with a customer via omnichannel and we upload a txt file, that file's URL redirects to a s3.amazonaws.com URL, which gets blocked due to CSP rules.

Workarounds are to

• disable frame-src CSP
• whitelist s3.amazonaws.com
• instruct customer to right click the link and paste it into a new tab to get the file

Steps to reproduce:

1. Set up live chat in an environment where the rocket chat domain is whitelisted for CSP (for us it's burkesoftware.rocket.chat)
2. Start a live chat
3. Someone uploads a file, the kind that shows a download icon
4. Click that download link

Expected behavior:

User clicks a link to download the file, and it downloads the file.

Actual behavior:

User clicks a link, and it does nothing (except show an error in the console).

Server Setup Information:

• Version of Rocket.Chat Server: 3.7.1
• Operating System: Linux
• Deployment Method:
• Number of Running Instances:
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

Client Setup Information

• Desktop App or Browser Version: Firefox 82
• Operating System: Pop!_OS 20.10

Additional context

Relevant logs:

Start by reproducing the omnichannel file-download flow in Firefox with a file URL that redirects to s3.amazonaws.com, then trace the download link and the frame-src CSP handling. Done means clicking the download link retrieves the file without disabling frame-src CSP or broadly whitelisting S3.