Switch virus scanner to use the Dbt scanner

[matthewford]

📝 A short description of the changes

• DBT requesting to switch to their AV scanner
• Changes how files are uploaded, first to a tmp bucket, then moved to a permanent bucket once scanned.

🔗 Link to the relevant story (or stories)

• https://app.asana.com/0/1207904458299124/1208011110352206/f

Testing dev PaaS bucket functionality 🪣

It is possible to test the files moving across buckets functionality using two sets of credentials that allow external access.
See https://docs.cloud.service.gov.uk/deploying_services/s3/#connect-to-an-s3-bucket-from-your-app for info on how to create and retrieve the keys.
Add the keys along with setting the other two ENV vars to enable scanning + scanner buckets:

AWS_TMP_BUCKET_ACCESS_KEY_ID=xxx
AWS_TMP_BUCKET_SECRET_ACCESS_KEY=xxx
AWS_PERMANENT_BUCKET_ACCESS_KEY_ID=xxx
AWS_PERMANENT_BUCKET_SECRET_ACCESS_KEY=xxx
DISABLE_VIRUS_SCANNER=false
ENABLE_VIRUS_SCANNER_BUCKETS=true

Deployment implications

• Requires access to the DBT scanners
• New env VARs need to be set
• Files need to be moved into the permanent bucket
• On GovPass, a new bucket must be created for the permanent files, and all files must be copied into the permanent bucket.

✅ Checklist

• Features that cannot go live are behind a feature flag/env var or specify deploy date and open PR as draft
• I have checked that commit messages make sense and explain the reasoning for each change
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I have squashed any unnecessary or part-finished commits

🖼️ Screenshots (if appropriate - no PII/Prod data):