Switch Content S3 Bucket to Use CloudFront Origin Access Control v2

[molly-moen]

This PR builds on #415, which breaks theater and prompter.
From #415:

We're no longer able to provision new Javabuilder Stacks. CloudFormation cannot provision the ContentBucketPolicy because of the BlockPublicPolicy setting.
Switch to using CloudFront Origin Access Control to enable students/teachers (the public) to fetch Objects in this bucket.
The Javabuilder Lambdas still have access through their Roles to read/write Objects in this Bucket.

This adds the following:

• Don't forward query strings, as we add cache bust urls that were causing the theater requests to fail. The query string will still work for cache busting, but won't cause a 403 anymore.
• Update the prompter urls to no longer route through Cloudfront, and instead use the raw S3 url. Per Claude "with OAC set to always, CloudFront adds its own SigV4 auth while forwarding the X-Amz-* presigned query params, and S3 rejects requests carrying two auth mechanisms ("Only one auth mechanism allowed"). The bucket policy also only grants s3:GetObject, so a CloudFront-signed PUT is denied regardless."

I deployed a dev instance with this change and it deployed and theater and prompter work as expected.

[cat5inthecradle]

Looks good!