Add option to disable pre-signed S3 URLs for artifact browsing

[mikenau]

Summary

When artifacts are accessed through Jenkins, this plugin redirects the browser to a pre-signed S3 URL. This breaks HTML reports that use relative links (e.g. <a href="page2.html">), because the browser resolves those links against the S3 URL rather than the Jenkins URL. We archive a large number of playwright reports and the trace files do not load properly when using a pre-signed S3 URL.

This PR adds a new Disable Presigned URLs configuration option. When enabled, JCloudsVirtualFile.toExternalURL() returns null, which tells Jenkins core to stream artifact content through the controller instead of redirecting to S3. This preserves relative links for HTML reports. Upload and stash/unstash operations are not affected.

Changes

• BlobStoreProvider: Added isDisablePresignedUrls() with a default of false so existing providers are unaffected
• S3BlobStoreConfig: Added disablePresignedUrls boolean field with @DataBoundSetter, following the same pattern as existing options
• S3BlobStore: Overrides isDisablePresignedUrls() to delegate to S3BlobStoreConfig
• JCloudsVirtualFile: toExternalURL() returns null when the option is enabled, causing Jenkins to proxy the artifact
• Config UI: Added a "Disable Presigned URLs" checkbox to the S3 configuration page with inline help
• Configuration as Code: The option is available as disablePresignedUrls: true under aws.s3

Configuration

Jenkins UI: Manage Jenkins > Amazon Web Services Configuration > "Disable Presigned URLs" checkbox

Configuration as Code:

aws:
  s3:
    disablePresignedUrls: true

Trade-offs

When enabled, all artifact downloads are proxied through the Jenkins controller, which increases controller load. This is acceptable for use cases where HTML report navigation is required.

Testing

• Configuration roundtrip test (`S3BlobStoreConfigTest`)
• Configuration as Code test (`ConfigAsCodeTest`)
• Default value is `false` (`S3BlobStoreConfigTest.disablePresignedUrlsDefaultIsFalse`)
• `toExternalURL()` returns a URL when presigned URLs are enabled (`DisablePresignedUrlsTest`)
• `toExternalURL()` returns `null` when presigned URLs are disabled (`DisablePresignedUrlsTest`)
• `open()` still works when presigned URLs are disabled, verifying the controller-proxy path (`DisablePresignedUrlsTest`)