s3: handle 307 redirects

[alxndrsn]

Depends on #715

[lognaturel]

Capturing some quick initial thoughts that I will chew on for a bit:

• the behavior is nice. It serves the primary goal of clients not needing to follow redirects. It doesn't fully hide the storage used because some headers may still come through from the provider but it does keep things like the bucket name private (though that's not actually private info)
• there's non-trivial overhead (see below)
• it would be nice for the DNS server to be configurable
• maybe the whole behavior could/should be opt-in

I did a few rounds of looking at request time and got consistent results that look like about 200ms extra than without which is itself already more than when the blobs were in the db (these relative values depend most on speed of application server and speed of db server; these are meaningful because they're Cloud infrastructure):

Without:

With:

From db: