Prevent modification of published blobs with S3 Object Lock legal holds

Published assets become immutable once they are published, including the corresponding S3 blobs. We should use S3's ["legal hold" system](https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-legal-hold.html) to enforce this at the S3 level. In order to enable this, we need to take the following steps

- [ ] Turn on S3 Object Lock on the S3 bucket
- this is required before legal holds can be used (see [docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-legal-hold.html))
- [ ] Update the [`publish` service layer module](https://github.com/dandi/dandi-archive/tree/master/dandiapi/api/services/publish) to apply legal holds to each blob during publishing
- This can be done efficiently using an S3 Batch Operation