Add option to disable presigned URL generation for public S3 buckets

[timbaev]

This PR adds a new configuration option generatePresignedUrls to the S3 artifact storage that allows users to disable the generation of presigned URLs and instead use direct S3 URLs for artifact access. This is useful when S3 buckets are configured with public read access and don't require authentication parameters in the URLs.

Key changes:

• Added generatePresignedUrls boolean configuration field (defaults to true for backward compatibility)
• Modified S3BlobStore.toExternalURL() and S3BlobStore.artifactUrls() to return direct URLs when presigned URL generation is disabled
• Added UI checkbox in the Jenkins configuration page with help documentation
• When disabled, URLs will be in the format https://bucket.s3.region.amazonaws.com/path/to/artifact without authentication parameters

Testing done

Automated tests:

• Added testDirectUrlGeneration() test in JCloudsArtifactManagerTest that verifies:
  • When generatePresignedUrls is set to false, the generated URLs do not contain presigned authentication parameters (X-Amz-Algorithm, X-Amz-Credential, X-Amz-Signature)
  • The test creates a workflow job, archives an artifact, and validates the URL format
• Added checkGeneratePresignedUrlsDefaultAndSetterGetter() test in S3BlobStoreConfigTest that verifies:
  • The default value is true (maintaining backward compatibility)
  • The setter and getter methods work correctly
• Updated existing config validation test to include the new parameter

Manual testing:

• Tested the configuration UI to ensure the checkbox appears and saves correctly
• Verified that existing configurations continue to work with presigned URLs (default behavior)
• Tested with a public S3 bucket to confirm direct URLs work without authentication

UI Screenshots:

Configuration page before changes

Configuration page after changes

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[jglick]

Presumably your automated & manual tests involved a bucket with public read access but I am unclear on what your automated & manual tests consisted of beyond that.

(The existence of https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-public-write-prohibited.html implies that public write access is technically possible, but that is certainly not something we would want to encourage.)

[timbaev]

@jglick Thanks for the review! Updated the logic to use the new parameter only for downloading artifacts. Also checked the test - it passes now.

[timbaev]

@jglick Hello 👋
Can you help with the review?

[timbaev]

@jglick Hello 👋
Any chance this could get reviewed? We’ve been using the fork together with MinIO for a month now, and it’s been working without any issues.

[jglick]

On my list but so far I have not found the time to review this (or indeed maintain this plugin much at all).