Add support for media proxying (for MSC3910)

[Half-Shot]

MSC3910 will introduce the requirement to authenticate media downloads, which will leave bridges like matrix-appservice-irc, which presently rely on unauthenticated media to function.

To combat this, this PR introduces a transparent proxy service that will allow unauthenticated media access to continue, albeit with more control over the scope and lifetime of the media. This is done by creating and signing some metadata, that is then provided as a URL for the media. This avoids the need for unbounded storage of media records in the bridge.

Problems:

• IRC relies upon these IDs being small, whereas right now we're using a lump of JSON which is anything but. We could add a gzip stage to see if that helps the duplication, or use a different format entirely.

[tadzik]

IRC relies upon these IDs being small, whereas right now we're using a lump of JSON which is anything but

Addressed this one in #498 with a tightly packed data format – brings mxc://example.com/some_media token from 208 to 128 bytes, with the same HMAC signature length.