prefer presigned urls when possible

[jmelahman]

Using bazel's download machinery, download (for files) and download_and_extract (for archives), has three main benefits:

1. it's fairly reliable -- aws s3 cp is generally disappointing + seems to get worse in large repos -- may get better pooling with bazel involved
2. gives access to bazel's repository_cache (I'm not sure if this is exposed outside of these APIs)
3. de-duplicate extraction logic

some tools, for example the aws cli, can generate a presigned url which can in turn be given to bazel to download. This allows direct downloads with bazel for private artifacts using standard AWS credentials.