Use signed URLs when possible with artifact store

# Summary

Right now when downloading an artifact, it's downloaded to a tmp file in the `argo-server` pod and subsequently returned to the client. When downloading large files, this causes a large delay since the file first has to be downloaded to the pod before being able to serve a single byte, and also potentially increases costs since you'll have increased network traffic.

When possible, we should use signed URLs with the artifact store and redirect users to download from the store directly.

---

**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Trace how argo-server currently handles artifact downloads and how it integrates with the artifact store. Implement redirects to signed artifact-store URLs when available, while preserving the existing download behavior when signing is unavailable; done means large artifacts can download directly from the store.

Written by the indexing model from the issue text.