[littlegrasscao]

Summary

• add UrlSigners in core, which picks a signer by path scheme and caps the URL lifetime to the catalog credential expiry
• sign S3 object URLs with AWS SigV4 presigning
• sign Azure blobs with the catalog SAS token, or a blob SAS from an account key
• sign GCS objects with V4 signatures, using the catalog-vended service account key file if present, otherwise Google application default credentials (no server setting)
• signers are plain classes, not wired into OpenSharing until the query endpoint uses them
• AWS credentials now require region: the local catalog's FAKE mode returns us-west-2, STATIC requires it, and ENV requires AWS_REGION or AWS_DEFAULT_REGION
• add the S3, Azure Blob, and Google Cloud Storage SDK dependencies

Testing

• mvn clean install: 171 tests passed
• S3UrlSignerTest, AzureSasUrlSignerTest, GcsUrlSignerTest, UrlSignersTest: signing offline with placeholder credentials, unknown schemes, and lifetime capping
• UrlSignerCloudIntegrationTest signs a real data file from the S3, Azure, and GCS test tables and reads its first byte; each case is skipped without credentials
• LocalCatalogConnectorTest checks the FAKE-mode region

Stacked on #107.