Add support for Signed URLs

[silvolu]

https://cloud.google.com/storage/docs/accesscontrol#Signed-URLs

I guess the only tricky bit is that a .p12 key is needed to sign the URLs, and in the future we will support auth scenarios where we don't have the key (e.g. compute engine service account)

[silvolu]

Aaaaaand it's already there.