Add signed Cloudfront URLs back for all artifacts

[codekansas]

Currently anyone can download anything. Instead, we should return signed Cloudfront URLs from the artifact endpoint(s) (like we previously did for kernel image downloads, but which was deleted today).

• Code pointer for previous S3 version
• Code pointer for Cloudfront implementation

Unlike the previous implementation, we want to generate the presigned Cloudfront URL instead of the S3 URL

To test this we need to add Cloudfront to localstack