Support signed URLs in IIIF requests

[kdid]

Summary

Add support for HMAC-signed URLs with an expires parameter.
This will make certain operations (like one-off downloads and redirects) a lot simpler.

[mbklein]

This is really fantastic and exactly what I was thinking. I just have two suggestions:

1. [Fully my fault, since I didn't consider this before writing the spec ticket] Change the id claim field to sub, expires to exp, and use pascalCase for the max-[dimension] fields, just to be consistent with JWT best practices.
2. Instead of just returning true or false from validateJwtClaims, maybe return { valid: [true|false], reason: reason } and then use the reason as the body of the 403 response (e.g., disallowed ${field} or subject doesn't match or maxWidth exceeded). I don't think that gives away too much about the implementation, and it would demonstrate to tinkerers that we're serious about checking the parameters. 😄

[kdid]

@mbklein - this is ready for re-review. Code is deployed live on staging.

[mbklein]

max-width and max-height aren't being enforced, because params.size isn't being parsed into width and height. It looks like 2048,1536 or !300,300 or even ,768 or pct:50. This is where all the stuff about the “full frame image” came from in the documentation of those fields – there was a whole discussion in the serverless-iiif repo about how to handle max dimensions in light of the fact that a savvy and patient user could simply request individual tiles that didn't violate the maximum and stitch them together.

The iiif-processor gem offers a way to calculate the effective width and height of the full image based on the parameters given even when a region is requested, but all things considered, I'm not convinced it's worth going to great lengths to support it right now. Maybe the best thing to do is remove max-width and max-height from the code and the docs and come back to it later if we feel the need. I'm willing to be persuaded otherwise.

[mbklein]

If you decide to remove the max-* support, consider the PR approved once that's done. Otherwise, I'm happy to pair on the rest of implementation if we have time.

[kdid]

@mbklein - I think this is ready for re-review!

It's deployed on staging and there should be a number of shared test evens on the viewer function (I was logged in as admin).

I wasn't sure what we'd want to do if the S3 object did not exist at all so I just logged it and let it pass on through? My thought was that right now the authorizer doesn't care if the object exists or not. Open to counter arguments.