Asset URL Signing

Provide access to non-public assets via an API endpoint that returns Signed URLs. How this is performed will vary by asset storage backend.

* Native URL Signing Support: For backends that natively support URL Signing (e.g. [AWS S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html), [Microsoft Planetary Computer](https://planetarycomputer.microsoft.com/docs/reference/sas/)), this would be a simple return of the signed URL generated by the storage services with private access credentials accessible to the Auth Proxy server.
* Custom URL Signing Support: For storage services that do not natively support signed URLs (e.g. [CloudFerro](https://docs.cloudferro.com/en/latest/s3/s3.html)), the STAC Auth Proxy will instead generate its own signed URLs. These URLs, when accessed, will stream assets from the upstream storage backend via private access credentials accessible to the Auth Proxy server.