FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

lib/url_helper.rb

@@ -38,6 +38,11 @@ class UrlHelper
     url.sub(/^http:/i, "")
   end
 
+  def self.secure_proxy_without_cdn(url)
+    url = url.sub(SiteSetting.Upload.absolute_base_url, "/secure-media-uploads")
+    self.absolute(url, nil)
+  end
+
   DOUBLE_ESCAPED_REGEXP ||= /%25([0-9a-f]{2})/i
 
   # Prevents double URL encode
@@ -48,16 +53,16 @@ class UrlHelper
     encoded
   end
 
-  def self.cook_url(url)
+  def self.cook_url(url, secure: false)
     return url unless is_local(url)
 
     uri = URI.parse(url)
     filename = File.basename(uri.path)
-    is_attachment = !FileHelper.is_supported_image?(filename)
+    is_attachment = !FileHelper.is_supported_media?(filename)
 
     no_cdn = SiteSetting.login_required || SiteSetting.prevent_anons_from_downloading_files
 
-    url = absolute_without_cdn(url)
+    url = secure ? secure_proxy_without_cdn(url) : absolute_without_cdn(url)
 
     unless is_attachment && no_cdn
       url = Discourse.store.cdn_url(url)