Consider using signed URLs instead of proxying

[adisbladis]

Using signed URLs is a better solution than the proxy having to sling all the data through.

This means among other things that a proxy can be deployed in different regions from the buckets without causing excessive egress traffic.

See https://cloud.google.com/storage/docs/access-control/signed-urls.

[flokli]

This is currently a bit clunky to use - however, there's googleapis/google-cloud-go#1495 which should improve matters, with a changeset at https://code-review.googlesource.com/c/gocloud/+/42871.