Support signed URLs

[brancz]

While likely not something Thanos is going to use, but it would be really nice to have an abstraction that supports pre-signed URLs for uploads by clients.

• GCS: https://cloud.google.com/storage/docs/access-control/signed-urls
• AWS: https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html (including minio, and Ceph)
• Azure: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

It may be that some providers don't support this, but I think that's ok in that case applications can implement uploads themselves as fallback or just don't use those providers.