distribute via signed s3 urls rather than signed cloudfront urls

[asjohnston-asf]

grfn.asf.alaska.edu originally distributed via signed S3 URLs using a similar mechanism. We implemented distribution via signed CloudFront URLs in late 2018 as an excuse to prototype with the service; there was never a compelling business case for it.

Transitioning back to signed S3 URLs will allow us to recoup a portion of our data distribution costs via the Global Data Egress Waiver, as well as reducing/eliminating costs for requests originating within AWS.

This PR will need to be merged in coordination with another PR to grfn-logging. The log-parse lambda of grfn-logging will need to once again generate EMS distribution metrics from S3 access logs, rather than CloudFront access logs.

After this PR is merged we can:

• delete CLOUDFRONT_KEY_PAIR_ID and PRIVATE_KEY_SECRET_NAME environment secrets
• remove the bucket policies from the grfn-content-[test|prod] buckets allowing read access to the now-defunct CloudFront Origin Access Identity
• delete the now-unused cloudfront-private-key AWS Secrets Manager secret