feat: add support for S3 presigned URLs (GET and PUT)

[fabianloebel]

This PR adds support for generating S3 Presigned URLs using AWS Signature Version 4. This allows users to grant temporary access to private objects for both reading (GET) and writing (PUT).

Why this is needed

Currently, the bucket library requires the application to handle all object streaming via its own backend. In many web architectures—specifically when building APIs that serve files to client browsers—it is more efficient and secure to:

• Generate a temporary, signed URL.
• Send that URL to the client.
• Let the client browser download or upload directly to/from S3 (or MinIO).

This feature was missing, so I implemented a builder pattern to make generating these URLs straightforward.

Changes

• Added bucket/presign_object module.
• Implemented AWS Signature Version 4 signing specifically for query parameters.
• Added a PresignBuilder that supports expires_in customization.
• Added integration tests in test/presign_test.gleam (verified against a local MinIO instance).