Use presigned URLs for build artifact uploads

[jpenilla]

Add a new v3 publishing flow that uses presigned S3 upload URLs. Artifacts uploaded through this flow are staged in object storage, verified during publish, copied to their final content-addressed paths, and then cleaned up.

Unlike the legacy flow, the v3 flow does not rely on pod-local staging or Kubernetes pod routing. It also allows identical publish requests to be retried safely.

The new flow is available through /v3/upload and /v3/publish. The hidden, unprefixed legacy /upload and /publish endpoints remain unchanged for existing clients. The companion PaperMC/fill-gradle#10 update migrates the Gradle plugin to the v3 flow.

Before enabling the v3 publishing flow in production, an administrator must configure cleanup in the Cloudflare dashboard:

1. Open R2 Object Storage.
2. Select the production Fill bucket.
3. Open Settings → Object lifecycle rules.
4. Create a rule with:
   • Rule name: Expire abandoned Fill uploads
   • Prefix: staging/
   • Action: Expire/delete objects
   • Age: 1 day
5. Save the rule.

The prefix restriction is important: the rule must only apply to staging/, not the final v1/objects/ paths.