[h5p] Privatize H5P bucket

Currently the files are fetched directly from a public S3 bucket (since we cannot control how the H5P libraries fetch their own assets, we cannot perform authentication through cookies).

In the future, consider using token-based app authentication (or similar mechanism) to authenticate H5P apps requests:

### Sample implementation

schema.ts:
```ts
export const h5pServe = {
params: {
itemId: {
$ref: 'http://graasp.org/#/definitions/uuid',
},
// content path (rest of route)
'*': {
type: 'string',
},
},
required: ['itemId', '*'],
additionalProperties: false,
};
```

service-api.ts
```ts
...

/**
* H5P assets proxy server
* Can be used to add access control to h5p content files
* With the current architecture, the H5P libraries control the
* fetching so we can't pass the server cookie
*/
fastify.get<{ Params: { itemId: string; '*': string } }>(
'/h5p-content/:itemId/*', // use * notation to catch rest of the route
{ schema: h5pServe },
async (request, reply) => {
const {
member,
log,
params: { itemId, '*': contentRoute }, // rest of route is renamed to parameter contentRoute
} = request;

// retrieve object (also checks for read permission)
const getItemTask = itemTaskManager.createGetTask(member, itemId);
const item = await taskRunner.runSingle>(getItemTask);
if (item === null) {
throw new H5PItemNotFoundError(itemId);
}

const storageRoot = item.extra?.[serviceMethod]?.contentFilePath;
if (!storageRoot) {
throw new H5PItemMissingExtraError(item);
}

// sanitize content route parameter: remove any leading /, ./ or ../
const safeContentRoute = contentRoute.replace(/^(?:\.*\/)+/, '');
const filepath = path.join(storageRoot, safeContentRoute);

const dlFileTask = fileTaskManager.createDownloadFileTask(member, {
reply,
filepath,
itemId,
});
return await taskRunner.runSingle(dlFileTask);
},
);
```