Open uploaded files using authed temporary URLs

[gnprice]

Fixes #1732.

[chrisbobbe]

Thanks, LGTM! There's an existing PR for the get-temporary-URL binding: #1780. But it's not as close to merge as this one is, so please merge at will. The only nit I think still might apply from my last review there, in #1780 (comment) :

The new endpoint isn't really about a message, so instead of messages.dart, let's put it in a new file like lib/api/route/uploads.dart.

But I don't feel strongly about it.

[gnprice]

Thanks for the review!

The new endpoint isn't really about a message, so instead of messages.dart, let's put it in a new file like lib/api/route/uploads.dart.

Ah indeed. The same logic applies to the existing binding for upload-file, I think. It'd be reasonable to move them both to a new such file.

OTOH the current way matches the organization in the API docs' left nav bar: both these endpoints are included under "Messages".

[chrisbobbe]

OTOH the current way matches the organization in the API docs' left nav bar: both these endpoints are included under "Messages".

Sure, that's good enough reason to leave them where they are. Ship it! 🙂