FEATURE: Uppy direct S3 multipart uploads in composer (#14051)

This pull request introduces the endpoints required, and the JavaScript functionality in the `ComposerUppyUpload` mixin, for direct S3 multipart uploads. There are four new endpoints in the uploads controller:

* `create-multipart.json` - Creates the multipart upload in S3 along with an `ExternalUploadStub` record, storing information about the file in the same way as `generate-presigned-put.json` does for regular direct S3 uploads
* `batch-presign-multipart-parts.json` - Takes a list of part numbers and the unique identifier for an `ExternalUploadStub` record, and generates the presigned URLs for those parts if the multipart upload still exists and if the user has permission to access that upload
* `complete-multipart.json` - Completes the multipart upload in S3. Needs the full list of part numbers and their associated ETags which are returned when the part is uploaded to the presigned URL above. Only works if the user has permission to access the associated `ExternalUploadStub` record and the multipart upload still exists.

  After we confirm the upload is complete in S3, we go through the regular `UploadCreator` flow, the same as `complete-external-upload.json`, and promote the temporary upload S3 into a full `Upload` record, moving it to its final destination.
* `abort-multipart.json` - Aborts the multipart upload on S3 and destroys the `ExternalUploadStub` record if the user has permission to access that upload.

Also added are a few new columns to `ExternalUploadStub`:

* multipart - Whether or not this is a multipart upload
* external_upload_identifier - The "upload ID" for an S3 multipart upload
* filesize - The size of the file when the `create-multipart.json` or `generate-presigned-put.json` is called. This is used for validation.

When the user completes a direct S3 upload, either regular or multipart, we take the `filesize` that was captured when the `ExternalUploadStub` was first created and compare it with the final `Content-Length` size of the file where it is stored in S3. Then, if the two do not match, we throw an error, delete the file on S3, and ban the user from uploading files for N (default 5) minutes. This would only happen if the user uploads a different file than what they first specified, or in the case of multipart uploads uploaded larger chunks than needed. This is done to prevent abuse of S3 storage by bad actors.

Also included in this PR is an update to vendor/uppy.js. This has been built locally from the latest uppy source at d613b849a6. This must be done so that I can get my multipart upload changes into Discourse. When the Uppy team cuts a proper release, we can bump the package.json versions instead.

lib/file_store/s3_store.rb

@@ -97,12 +97,13 @@ module FileStore
 
       # if this fails, it will throw an exception
       if opts[:move_existing] && opts[:existing_external_upload_key]
+        original_path = opts[:existing_external_upload_key]
         path, etag = s3_helper.copy(
-          opts[:existing_external_upload_key],
+          original_path,
           path,
           options: options
         )
-        s3_helper.delete_object(opts[:existing_external_upload_key])
+        delete_file(original_path)
       else
         path, etag = s3_helper.upload(file, path, options)
       end
@@ -111,6 +112,12 @@ module FileStore
       [File.join(absolute_base_url, path), etag]
     end
 
+    def delete_file(path)
+      # delete the object outright without moving to tombstone,
+      # not recommended for most use cases
+      s3_helper.delete_object(path)
+    end
+
     def remove_file(url, path)
       return unless has_been_uploaded?(url)
       # copy the removed file to tombstone
@@ -217,7 +224,15 @@ module FileStore
 
     def signed_url_for_temporary_upload(file_name, expires_in: S3Helper::UPLOAD_URL_EXPIRES_AFTER_SECONDS, metadata: {})
       key = temporary_upload_path(file_name)
-      presigned_put_url(key, expires_in: expires_in, metadata: metadata)
+      presigned_url(
+        key,
+        method: :put_object,
+        expires_in: expires_in,
+        opts: {
+          metadata: metadata,
+          acl: "private"
+        }
+      )
     end
 
     def temporary_upload_path(file_name)
@@ -297,17 +312,72 @@ module FileStore
       FileUtils.mv(old_upload_path, public_upload_path) if old_upload_path
     end
 
-    private
-
-    def presigned_put_url(key, expires_in: S3Helper::UPLOAD_URL_EXPIRES_AFTER_SECONDS, metadata: {})
-      signer = Aws::S3::Presigner.new(client: s3_helper.s3_client)
-      signer.presigned_url(
-        :put_object,
+    def abort_multipart(key:, upload_id:)
+      s3_helper.s3_client.abort_multipart_upload(
         bucket: s3_bucket_name,
         key: key,
+        upload_id: upload_id
+      )
+    end
+
+    def create_multipart(file_name, content_type)
+      key = temporary_upload_path(file_name)
+      response = s3_helper.s3_client.create_multipart_upload(
         acl: "private",
-        expires_in: expires_in,
-        metadata: metadata
+        bucket: s3_bucket_name,
+        key: key,
+        content_type: content_type
+      )
+      { upload_id: response.upload_id, key: key }
+    end
+
+    def presign_multipart_part(upload_id:, key:, part_number:)
+      presigned_url(
+        key,
+        method: :upload_part,
+        expires_in: S3Helper::UPLOAD_URL_EXPIRES_AFTER_SECONDS,
+        opts: {
+          part_number: part_number,
+          upload_id: upload_id
+        }
+      )
+    end
+
+    def list_multipart_parts(upload_id:, key:)
+      s3_helper.s3_client.list_parts(
+        bucket: s3_bucket_name,
+        key: key,
+        upload_id: upload_id
+      )
+    end
+
+    def complete_multipart(upload_id:, key:, parts:)
+      s3_helper.s3_client.complete_multipart_upload(
+        bucket: s3_bucket_name,
+        key: key,
+        upload_id: upload_id,
+        multipart_upload: {
+          parts: parts
+        }
+      )
+    end
+
+    private
+
+    def presigned_url(
+      key,
+      method:,
+      expires_in: S3Helper::UPLOAD_URL_EXPIRES_AFTER_SECONDS,
+      opts: {}
+    )
+      signer = Aws::S3::Presigner.new(client: s3_helper.s3_client)
+      signer.presigned_url(
+        method,
+        {
+          bucket: s3_bucket_name,
+          key: key,
+          expires_in: expires_in,
+        }.merge(opts)
       )
     end