S3 Upload with CDN should support signed cloudfront URLs

Your Rocket.Chat version: (make sure you are running the latest)
0.32.0

This is the logical next step when supporting S3. For obvious reasons (Which is why you are currently signing the S3 urls) it's a security risk to use a CloudFront CDN without using some form of authentication on a private server. (Think of people sharing sensitive documents)

I'm sure much of the same code can be reused, all that needs to happen is that instead of signing an S3 canned policy document for the &Signature= , you need to sign a CloudFront canned policy document as outlined here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-canned-policy.html

I think this could be presented to the user as a checkbox underneath the current CDN input box titled:

• CloudFront Signed URLs

Which would have the effect of simply changing the signed policy document from that of an S3 canned policy to that of a cloudfront canned policy.

Start by locating the existing S3 upload URL-signing logic and the CDN configuration referenced in the issue. Read the linked AWS CloudFront canned-policy documentation and compare it with the current S3 signing flow. Done means an optional CloudFront Signed URLs setting is available and private CDN uploads produce authenticated URLs.