S3 presigned uploads

A starts-with key condition lets one signed S3 upload write anywhere under the prefix

Four HackerOne reports cited in a dev.to analysis trace to S3 write scope set wider than the one object an upload needs. Only one of them is the starts-with key condition that turns a signed upload form into write access across a whole prefix.